emotet | e368c85ee14f4888f3d90c5b7ba3ce1b5a83f99446f6eb7c54bf177ab8c04085

Analysis

max time kernel
144s
max time network
149s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/11/2022, 00:40

Target

65834980d19021397076facf09ade76a.dll
Size

727KB
MD5

65834980d19021397076facf09ade76a
SHA1

31109d0a7cd1392b7208c0b134fe71d096a3d639
SHA256

e368c85ee14f4888f3d90c5b7ba3ce1b5a83f99446f6eb7c54bf177ab8c04085
SHA512

100ab475d332ebf2ac6178d7e792615396d1bcdb14f43082a504573dafbcaee3d4ab8cb7b930eae2bd4e7a481a01259930fec4908d3229a70d15f548cf73cd66
SSDEEP

12288:ezhsu7PWe6Fth9tmzQS+37pzGIz/mXpo1z+HSjq+DsCJqzfo:ktR6rhjmzhsT/Yg6yjtJqzf

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
832	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1020	832	regsvr32.exe	27
PID 832 wrote to memory of 1020	832	regsvr32.exe	27
PID 832 wrote to memory of 1020	832	regsvr32.exe	27
PID 832 wrote to memory of 1020	832	regsvr32.exe	27
PID 832 wrote to memory of 1020	832	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\65834980d19021397076facf09ade76a.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ScwHyADpljlx\PlXjRvmt.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1020

memory/832-54-0x000007FEFB751000-0x000007FEFB753000-memory.dmp

Filesize
8KB

Download
memory/832-55-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download