emotet | e5a7646438a7d20d1a3bb02d71f97eed76811071175934d418d3e340104b3985

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-11-2022 01:53

Target

dc3facd7884439c722600f7aff1a48f4.dll
Size

727KB
MD5

dc3facd7884439c722600f7aff1a48f4
SHA1

01071d7053193cd74c23bcec6343a8798dba5f6d
SHA256

e5a7646438a7d20d1a3bb02d71f97eed76811071175934d418d3e340104b3985
SHA512

c75dc32b9ca7145f83fd2974e2f166baeb726decbb6f2e45eb5eeb1e3d2d11856e8fb779a4c189c9f22dbef4cd42c874e03e7e79d4d5d2d5e5714d04993a50ea
SSDEEP

12288:ezhsu7PWe6Fth9tmzQS+37pzGIz/mXpo1z+FSjq+DsCJqzfo:ktR6rhjmzhsT/Yg6kjtJqzf

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1260	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 988	1260	regsvr32.exe	26
PID 1260 wrote to memory of 988	1260	regsvr32.exe	26
PID 1260 wrote to memory of 988	1260	regsvr32.exe	26
PID 1260 wrote to memory of 988	1260	regsvr32.exe	26
PID 1260 wrote to memory of 988	1260	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dc3facd7884439c722600f7aff1a48f4.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ACsPIgoZzqRsaH\iBOtj.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:988

memory/1260-54-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmp

Filesize
8KB

Download
memory/1260-55-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download