emotet | 5ee9d6818730198fb213f657402fb587f25fdb64017cea1706a35fb8dbda7776

Analysis

max time kernel
144s
max time network
150s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/11/2022, 01:08

Target

b42e61ac4550d33e577a62c57124066a.dll
Size

727KB
MD5

b42e61ac4550d33e577a62c57124066a
SHA1

e7065dfd7b064d2f27cd22d23bb214a0f603010f
SHA256

5ee9d6818730198fb213f657402fb587f25fdb64017cea1706a35fb8dbda7776
SHA512

5d725c24096bd67dff400d23712b499ad5ad10ae1cb9c422ad98b098249b612dc1f218698d48ea72d76f3660f789d13ae2cda8fd3613698f219d6bf826706035
SSDEEP

12288:ezhsu7PWe6Fth9tmzQS+37pzGIz/mXpo1z+dSjq+DsCJqzfo:ktR6rhjmzhsT/Yg6sjtJqzf

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1572	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 2012	1572	regsvr32.exe	27
PID 1572 wrote to memory of 2012	1572	regsvr32.exe	27
PID 1572 wrote to memory of 2012	1572	regsvr32.exe	27
PID 1572 wrote to memory of 2012	1572	regsvr32.exe	27
PID 1572 wrote to memory of 2012	1572	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b42e61ac4550d33e577a62c57124066a.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AkZIO\zyYijFJpu.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2012

memory/1572-54-0x000007FEFBD81000-0x000007FEFBD83000-memory.dmp

Filesize
8KB

Download
memory/1572-55-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download