emotet | 4820a132ff73343160b6bb2f309ac35728d37bfe43cc5a5673f6ffbfcf485001

Analysis

max time kernel
145s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/11/2022, 19:57

Target
fc29f9d65479d3f5e41ba4eb7f86fdee.dll
Size 629KB
Sample221102-yn8xrsbde2
SHA256 4820a132ff73343160b6bb2f309ac35728d37bfe43cc5a5673f6ffbfcf485001
MD5 fc29f9d65479d3f5e41ba4eb7f86fdee
SHA1 ed1564cf8555928583228118071b22a60e8fce3e
SHA512 87e7cdf0a1e4d000987dde7525eb51d395c0bdbbc5a74eb617daaf23d0c251e029e17b2e583d75d9e7f2813872cfd752d1317049598132b83b9d4dfae56ab0c5
SSDEEP 12288:6tGis7p49VmD3OjG7QbBtLI5WhNye5JHKVu6cig1Doa:6tGis1T3OjueLvhd5NKAD3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1212	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 1524	1212	regsvr32.exe	27
PID 1212 wrote to memory of 1524	1212	regsvr32.exe	27
PID 1212 wrote to memory of 1524	1212	regsvr32.exe	27
PID 1212 wrote to memory of 1524	1212	regsvr32.exe	27
PID 1212 wrote to memory of 1524	1212	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fc29f9d65479d3f5e41ba4eb7f86fdee.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\OaNznp\iMGaShfayAm.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1524

memory/1212-54-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Download

memory/1212-55-0x0000000180000000-0x000000018002F000-memory.dmp

Download