emotet | 92cfc9a062c5246798f790a5ed098e57afd3d7f0d9b1a6d7aa45888e633f6403

Analysis

max time kernel
150s
max time network
150s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
02/11/2022, 17:56

Target

92cfc9a062c5246798f790a5ed098e57afd3d7f0d9b1a6d7aa45888e633f6403.dll
Size

629KB
MD5

eca90312470bdedb45a462487e45ee10
SHA1

a8ba8c719b024979d104a78f7d5b4f441f0f338e
SHA256

92cfc9a062c5246798f790a5ed098e57afd3d7f0d9b1a6d7aa45888e633f6403
SHA512

10a881b63e98806d104c9ee348f31c94c3ea2a7c92a3f08f394753662a316660eb48afb5f3f317be524595b4b07ac22c985916cb0b02acd33c5d7a6376ae8e81
SSDEEP

12288:6tGis7p49VmD3OjG7QbBtLg5WhNye5JHKVu6cig1Doa:6tGis1T3OjueLnhd5NKAD3

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3828	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 4316	3828	regsvr32.exe	67
PID 3828 wrote to memory of 4316	3828	regsvr32.exe	67

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\92cfc9a062c5246798f790a5ed098e57afd3d7f0d9b1a6d7aa45888e633f6403.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RnXMl\OVxRIUfbzYWLw.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4316

memory/3828-116-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download