emotet | 33b56c4a5c96f2bd15cbc72a07a5cc8030d450b57c3de45a3aebe3f529db7736

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/11/2022, 01:14

Target

7ffe87e6ac2d0ec90aad8a19483efd16.dll
Size

629KB
MD5

7ffe87e6ac2d0ec90aad8a19483efd16
SHA1

cdb3383fbf98ae9d0b1842283aafeac11e062b35
SHA256

33b56c4a5c96f2bd15cbc72a07a5cc8030d450b57c3de45a3aebe3f529db7736
SHA512

8da2c75c7efe861389aa98672cd4ce9d12cf81b701917042b92791430c697737ad726dbdf310c911c90abcb9c4fae1bf510ee36af41942071d43a45c97941bc2
SSDEEP

12288:6tGis7p49VmD3OjG7QbBtLC5WhNye5JHKVu6cig1Doa:6tGis1T3OjueLdhd5NKAD3

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1912	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1112	1912	regsvr32.exe	28
PID 1912 wrote to memory of 1112	1912	regsvr32.exe	28
PID 1912 wrote to memory of 1112	1912	regsvr32.exe	28
PID 1912 wrote to memory of 1112	1912	regsvr32.exe	28
PID 1912 wrote to memory of 1112	1912	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7ffe87e6ac2d0ec90aad8a19483efd16.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YdChASYHJ\FwIiocdz.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1112

memory/1912-54-0x000007FEFC1F1000-0x000007FEFC1F3000-memory.dmp

Filesize
8KB

Download
memory/1912-55-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download