emotet | 2c856b198e4b5be28f024fa313a9126f4f2c58017c900b87fd0a820d185a62a8

Analysis

max time kernel
140s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/11/2022, 22:28

Target
549fbcf370a79395942dde1e5bc6e8d4.dll
Size 745KB
Sample221103-2dmtbsabej
SHA256 2c856b198e4b5be28f024fa313a9126f4f2c58017c900b87fd0a820d185a62a8
MD5 549fbcf370a79395942dde1e5bc6e8d4
SHA1 95f77d0e49a54611f41c050bb4c73289af86e02d
SHA512 dceeb067599dd434d58ce8ec84a191673935e298bcd891ddcf6ab71c32d40ba946b7096ef935ac66c89f25cdacfe86c0c90345c3c81a7046c00fae858f5b58a8
SSDEEP 6144:i5htEuwPCwdooxhXLY/3tvDc2YLV9yWoPTvtQPZOBk8DvpyGj/eoyOyqTJDrRtFw:EaCwpDXstOby/ZQPrnGbWEJDDFY1cA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1988	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1664	1988	regsvr32.exe	26
PID 1988 wrote to memory of 1664	1988	regsvr32.exe	26
PID 1988 wrote to memory of 1664	1988	regsvr32.exe	26
PID 1988 wrote to memory of 1664	1988	regsvr32.exe	26
PID 1988 wrote to memory of 1664	1988	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\549fbcf370a79395942dde1e5bc6e8d4.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\CJvPV\yhSjRXsihLn.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1664

memory/1988-54-0x000007FEFBF01000-0x000007FEFBF03000-memory.dmp

Download

memory/1988-55-0x0000000180000000-0x000000018002F000-memory.dmp

Download