emotet | b5b306b6576a7c53f51bf47d43b8ea2f095a321a43867cd233aa66d23b4ca0f8 | Triage

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/11/2022, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

em16.dll
Size

629KB
MD5

004b591271103ab12413a2403c61916f
SHA1

963e44dcc556be60dfeffbe24e58187a834f9425
SHA256

b5b306b6576a7c53f51bf47d43b8ea2f095a321a43867cd233aa66d23b4ca0f8
SHA512

32968a90637400fd217943e7d242cc58a3fc4722be9cea206eca485045071cea4915c86a4b75cd95b56a3d4081023c8e0c1d6d9e6f42a74abc2cdaeb0d9cc444
SSDEEP

12288:6tGis7p49VmD3OjG7QbBtLY5WhNye5JHKVu6cig1Doa:6tGis1T3OjueL/hd5NKAD3

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1052	regsvr32.exe
952	regsvr32.exe
952	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1052	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 952	1052	regsvr32.exe	28
PID 1052 wrote to memory of 952	1052	regsvr32.exe	28
PID 1052 wrote to memory of 952	1052	regsvr32.exe	28
PID 1052 wrote to memory of 952	1052	regsvr32.exe	28
PID 1052 wrote to memory of 952	1052	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\em16.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WQFZdoUGbd\wutpBcmHSqWZ.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1052-54-0x000007FEFBC41000-0x000007FEFBC43000-memory.dmp

Filesize
8KB

Download
memory/1052-55-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download