emotet | 225bf7406e0a62796ce5b4e91925cf37cbe71ff7db5b57894e0c899cf8bb016b

Analysis

max time kernel
146s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/11/2022, 11:07

Target
94165d684c05d763428de021ecdd7a7d.dll
Size 664KB
Sample221102-m7zbwsbcg5
SHA256 225bf7406e0a62796ce5b4e91925cf37cbe71ff7db5b57894e0c899cf8bb016b
MD5 94165d684c05d763428de021ecdd7a7d
SHA1 78fff8f6abb418b6ddb13984acf823c875999d27
SHA512 56aae033496599cfda28edebb8fa9d0a9a34b8b1dece9822062dcc5ce048437d73c1fcd6f52472ac1bafc3124862f7167b14ebe33b6f34f4081236cbb29c412f
SSDEEP 12288:v9D2/XRIK1chzV2rBt5APJlGIu4cDVi8HY1lW+lJk1XY61IU:lD2vRA2rv5APJfu4jiY18+lJkt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2020	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 744	2020	regsvr32.exe	26
PID 2020 wrote to memory of 744	2020	regsvr32.exe	26
PID 2020 wrote to memory of 744	2020	regsvr32.exe	26
PID 2020 wrote to memory of 744	2020	regsvr32.exe	26
PID 2020 wrote to memory of 744	2020	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\94165d684c05d763428de021ecdd7a7d.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\OzQAgVOBgYEckV\OCIwEIGWGNnAFZHt.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:744

memory/2020-54-0x000007FEFBAB1000-0x000007FEFBAB3000-memory.dmp

Download

memory/2020-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download