emotet | fcfdf98ad8ba0dc4e423f97a9fc8f0ef9b5988326199c229ee21381b8c759062

Analysis

max time kernel
144s
max time network
149s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-11-2022 21:16

Target

fcfdf98ad8ba0dc4e423f97a9fc8f0ef9b5988326199c229ee21381b8c759062.dll
Size

809KB
MD5

3ca1de6580217e325eb23917f261fcbf
SHA1

4dd19d94a920a52ba611ece5b517498ca67bf0d8
SHA256

fcfdf98ad8ba0dc4e423f97a9fc8f0ef9b5988326199c229ee21381b8c759062
SHA512

17cd35b9fd0f8ab2f13ea609c3988463244f7610c7771bd0d7b4d6c3df48383579ae205a09dd5d7b0081f53c4fd0a1e1dbfbbeed5be6e8d39aacfb2e073cee4f
SSDEEP

24576:fp7r9TOZH6Xf/Xfs11IWzsY6gB/d833dBG:hX9qZH4f01IWzsTgRw3C

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1648	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1484	1648	regsvr32.exe	28
PID 1648 wrote to memory of 1484	1648	regsvr32.exe	28
PID 1648 wrote to memory of 1484	1648	regsvr32.exe	28
PID 1648 wrote to memory of 1484	1648	regsvr32.exe	28
PID 1648 wrote to memory of 1484	1648	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fcfdf98ad8ba0dc4e423f97a9fc8f0ef9b5988326199c229ee21381b8c759062.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\CSUBIbLXDIQgQHQmz\msUg.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1484

memory/1648-54-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Filesize
8KB

Download
memory/1648-55-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download