emotet | 7ef401dbf6a1669596fe5f4bef6ec56c7cdeda6b3a745a7bac14103a85cd7ac3

Analysis

max time kernel
144s
max time network
150s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/11/2022, 23:47

Target
dd5f92c44b2050314dbac8761b7edc2d.dll
Size 629KB
Sample221102-3svm6afdek
SHA256 7ef401dbf6a1669596fe5f4bef6ec56c7cdeda6b3a745a7bac14103a85cd7ac3
MD5 dd5f92c44b2050314dbac8761b7edc2d
SHA1 181f2d39c98653440c923dc6f0b42643162556aa
SHA512 36760689bb6b56a170500035d37f27bbc7fbcb90e7669febd37ee0064692fa67cd222a64b0069430879c3355bc60f2a381d46e42ed4a07ee34286b3b986e8853
SSDEEP 12288:6tGis7p49VmD3OjG7QbBtLz5WhNye5JHKVu6cig1Doa:6tGis1T3OjueLEhd5NKAD3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2016	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1092	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1092	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1092	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1092	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1092	2016	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dd5f92c44b2050314dbac8761b7edc2d.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\BZlgjTyAZv\DQcx.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1092

memory/2016-54-0x000007FEFBF41000-0x000007FEFBF43000-memory.dmp

Download

memory/2016-55-0x0000000180000000-0x000000018002F000-memory.dmp

Download