emotet | a97ea40832c0a8549aa85340d9541ba7135cca94b22c64b61d8d6e9744e8cbfa

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/11/2022, 22:29

Target
503e2a05377c84d08a1973ac015024ce.dll
Size 751KB
Sample221103-2d7thaabep
SHA256 a97ea40832c0a8549aa85340d9541ba7135cca94b22c64b61d8d6e9744e8cbfa
MD5 503e2a05377c84d08a1973ac015024ce
SHA1 90f7feb6cb8ef2bd8972023ec646ad0627d20655
SHA512 57e276a8fd65c7ec17ff1b9f453d10bea5b3172a9a86eea0283dda004022bc702e29cb7bc7dd456d4148541fb975edb7f01c2810ab9ba908331899afed19aa71
SSDEEP 12288:8iW4+vsmQhWi6zQCXbPlPyqOMSRZuH/sAvvszVIf:8iWHhECXbPlPyqOMUMJvszVIf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

ecs1.plain

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1336	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 1728	1336	regsvr32.exe	27
PID 1336 wrote to memory of 1728	1336	regsvr32.exe	27
PID 1336 wrote to memory of 1728	1336	regsvr32.exe	27
PID 1336 wrote to memory of 1728	1336	regsvr32.exe	27
PID 1336 wrote to memory of 1728	1336	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\503e2a05377c84d08a1973ac015024ce.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\SfybGZPkZTiKrM\cHlVHjeJAW.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1728

memory/1336-54-0x000007FEFBB41000-0x000007FEFBB43000-memory.dmp

Download

memory/1336-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download