emotet | 3355498e3ed5c6617f7202f20981eb530ffda5edb4e6060961b02ea5b5e9b109

Analysis

max time kernel
123s
max time network
137s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-11-2022 03:38

Target

CzbuYplVvPl.dll
Size

519KB
MD5

f7631b14a4407b66bb35e5566bed14d6
SHA1

159777807605cea2d8cf4fdb0f2bea9d8452e4b0
SHA256

3355498e3ed5c6617f7202f20981eb530ffda5edb4e6060961b02ea5b5e9b109
SHA512

8682765817082f745bb5f8481538058b73a361414b599770c4fedd9b76957160fcad366f71960c73cbeb4e11b1a17b57ee8347e80127849ff029cbb66e05074e
SSDEEP

12288:rWk5FCMrRO3jL5ILEtLrcmLlsLm/0GD5+SdANBgZ2AY1Ll8fKhycVJ:rWgozL5ILEtNLlcmfD5+SdANGZ2AY1LV

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1008	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 1552	1008	regsvr32.exe	28
PID 1008 wrote to memory of 1552	1008	regsvr32.exe	28
PID 1008 wrote to memory of 1552	1008	regsvr32.exe	28
PID 1008 wrote to memory of 1552	1008	regsvr32.exe	28
PID 1008 wrote to memory of 1552	1008	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\CzbuYplVvPl.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MyLIDPZtAvjJDSrtq\wKbuPEHlWl.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1552

memory/1008-54-0x000007FEFB901000-0x000007FEFB903000-memory.dmp

Filesize
8KB

Download
memory/1008-55-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download