emotet | b2847c29dd151f5db72e23269672e7e134adcc0c1ea5aa0cb67c1c33cf64f1b0

Analysis

max time kernel
143s
max time network
148s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/11/2022, 01:01

Target
069ece0498f589e6a6439c4a02f22a32.dll
Size 727KB
Sample221103-bc8fjadcb5
SHA256 b2847c29dd151f5db72e23269672e7e134adcc0c1ea5aa0cb67c1c33cf64f1b0
MD5 069ece0498f589e6a6439c4a02f22a32
SHA1 c9561d10bfd89e93372224c624f2459db867751d
SHA512 bc32f022ab1358099d594700eacdc2b450b7f15804dd7dd9ebf69c73fbfd66783a9d4502b2d7e3cc2f526a974928b366acd4386cf26961c943090c50e9729aec
SSDEEP 12288:ezhsu7PWe6Fth9tmzQS+37pzGIz/mXpo1z+uSjq+DsCJqzfo:ktR6rhjmzhsT/Yg6PjtJqzf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2020	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1916	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1916	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1916	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1916	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1916	2020	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\069ece0498f589e6a6439c4a02f22a32.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YeBtZGAPg\ZGrRZeBsXQZzW.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1916

memory/2020-54-0x000007FEFC2C1000-0x000007FEFC2C3000-memory.dmp

Download

memory/2020-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download