emotet | eb91a9c8339e00b3210c756deaf3fe3525c1741ae3580bffd6e19d4dfd9c54a2

Analysis

max time kernel
135s
max time network
146s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
03-11-2022 08:24

Target

eb91a9c8339e00b3210c756deaf3fe3525c1741ae3580bffd6e19d4dfd9c54a2.dll
Size

814KB
MD5

5582755aae640a6e4e075ec10630b166
SHA1

4772ec1b0da0a020aed0faef58600075c9942487
SHA256

eb91a9c8339e00b3210c756deaf3fe3525c1741ae3580bffd6e19d4dfd9c54a2
SHA512

829616216027470a44496d62f1b3c2c81776ac9b89a9153e6788a7056f6245f8830873a8389fcf98df2b244f9683d4d3b320356afdc3b8ea7eb16e825a71d4e2
SSDEEP

12288:5sIyzbpudwh9PQx873eHeLs15pZ6yRQOf04Tn/WMideaik:5JyzbwdG4eLsjpZfRQo/q8fk

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3176	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 3712	3176	regsvr32.exe	66
PID 3176 wrote to memory of 3712	3176	regsvr32.exe	66

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\eb91a9c8339e00b3210c756deaf3fe3525c1741ae3580bffd6e19d4dfd9c54a2.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GZZpwCekljsN\jcOlQ.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3712

memory/3176-115-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download
memory/3712-120-0x0000000000000000-mapping.dmp

Download