emotet | 3355498e3ed5c6617f7202f20981eb530ffda5edb4e6060961b02ea5b5e9b109

Analysis

max time kernel
119s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2022 03:38

Target

CzbuYplVvPl.dll
Size

519KB
MD5

f7631b14a4407b66bb35e5566bed14d6
SHA1

159777807605cea2d8cf4fdb0f2bea9d8452e4b0
SHA256

3355498e3ed5c6617f7202f20981eb530ffda5edb4e6060961b02ea5b5e9b109
SHA512

8682765817082f745bb5f8481538058b73a361414b599770c4fedd9b76957160fcad366f71960c73cbeb4e11b1a17b57ee8347e80127849ff029cbb66e05074e
SSDEEP

12288:rWk5FCMrRO3jL5ILEtLrcmLlsLm/0GD5+SdANBgZ2AY1Ll8fKhycVJ:rWgozL5ILEtNLlcmfD5+SdANGZ2AY1LV

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1584	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 4296	1584	regsvr32.exe	82
PID 1584 wrote to memory of 4296	1584	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\CzbuYplVvPl.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TsNMjtucIWRNqjVU\qMpiQBOc.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4296

memory/1584-132-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download