emotet | d348d15b455d4610bdea1b2c6a3d3d4ef408ac33a0ecc76fc0a6cc374cde4083

Analysis

max time kernel
144s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/11/2022, 16:10

Target
sv5XFx0HN.dll
Size 664KB
Sample221102-tmcqqacfep
SHA256 d348d15b455d4610bdea1b2c6a3d3d4ef408ac33a0ecc76fc0a6cc374cde4083
MD5 8c721173ba4a1b97220e13c78d4363ed
SHA1 9f24d0709eb62ec0026e6f9f5280247ce0d4322c
SHA512 52f369c3972caa95139cbdc6d5c223cd38c30c6030c6a5f4c61dc746fc1fb1bf46447182f48a87744edeb9da5b8a91a5ad467b5a5cd66e325b03e7465d216193
SSDEEP 12288:v9D2/XRIK1chzV2rBt5APJlGIv4cDVi8HY1lW+lJk1XY61IU:lD2vRA2rv5APJfv4jiY18+lJkt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1928	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1116	1928	regsvr32.exe	26
PID 1928 wrote to memory of 1116	1928	regsvr32.exe	26
PID 1928 wrote to memory of 1116	1928	regsvr32.exe	26
PID 1928 wrote to memory of 1116	1928	regsvr32.exe	26
PID 1928 wrote to memory of 1116	1928	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\sv5XFx0HN.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\QQNnmJ\hDBHpx.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1116

memory/1928-54-0x000007FEFC161000-0x000007FEFC163000-memory.dmp

Download

memory/1928-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download