emotet | 75fa0c99bcf8844558103d4e2b122095d44275039d345e8732793afdf09f29b5

Analysis

max time kernel
143s
max time network
148s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/11/2022, 11:57

Target
72645566b6f9baec7556ca34cd246305.dll
Size 664KB
Sample221102-n4kvrscdbl
SHA256 75fa0c99bcf8844558103d4e2b122095d44275039d345e8732793afdf09f29b5
MD5 72645566b6f9baec7556ca34cd246305
SHA1 b465bcd533569bac021afc5ebb0375ca1cb8d2b2
SHA512 9b3a390e36df24764e4640b0752dc01780db81e29263acc5398c5554cb004b45b89edaec0120093d0e31db26cc8b69668ea63a57132fc8967ee816cc16f7c52e
SSDEEP 12288:v9D2/XRIK1chzV2rBt5APJlGIo4cDVi8HY1lW+lJk1XY61IU:lD2vRA2rv5APJfo4jiY18+lJkt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2024	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 112	2024	regsvr32.exe	26
PID 2024 wrote to memory of 112	2024	regsvr32.exe	26
PID 2024 wrote to memory of 112	2024	regsvr32.exe	26
PID 2024 wrote to memory of 112	2024	regsvr32.exe	26
PID 2024 wrote to memory of 112	2024	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\72645566b6f9baec7556ca34cd246305.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MLEsN\tgIyLkFZoAnwdupq.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:112

memory/2024-54-0x000007FEFC251000-0x000007FEFC253000-memory.dmp

Download

memory/2024-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download