emotet | 292ada6d0246b9ba25fb72cc2033178c716d84d985e002a41dd45a7e4fed88ab

Resubmissions

03/11/2022, 19:09

02/11/2022, 07:29

max time kernel
300s
max time network
298s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/11/2022, 07:29

Target
e4-c1548f0f240e02578826100e65fafc65.dll
Size 660KB
Sample221102-jbee3aahfp
SHA256 292ada6d0246b9ba25fb72cc2033178c716d84d985e002a41dd45a7e4fed88ab
MD5 c1548f0f240e02578826100e65fafc65
SHA1 30e8a81f5e8e2c3fbf574b0532fd6dbdaf5b91eb
SHA512 6acae3c0d1f3b100923f680a15f515c41c5caed0ed433252d895373f4601672e4802a67e604c8b484317fd295b0912362810f79e44fb4b33f99ba945209e42a3
SSDEEP 12288:H6NFi+qz19gtAgY2tiZl4l/aukg78I8v4lSRi4gu2CTRD:aNY19gigZtiZywukmQAlQEG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1708	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 684	1708	regsvr32.exe	27
PID 1708 wrote to memory of 684	1708	regsvr32.exe	27
PID 1708 wrote to memory of 684	1708	regsvr32.exe	27
PID 1708 wrote to memory of 684	1708	regsvr32.exe	27
PID 1708 wrote to memory of 684	1708	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e4-c1548f0f240e02578826100e65fafc65.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZVSHxev\biLOFjEITjLRHbg.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:684

memory/1708-54-0x000007FEFB7F1000-0x000007FEFB7F3000-memory.dmp

Download

memory/1708-55-0x0000000180000000-0x000000018002F000-memory.dmp

Download