emotet | 2232571338979c6fe5080b96855fbdc700c6fba0005cbb059770ec9519adfec0

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/11/2022, 08:58

Target

fbb424daac6c96238d44e80b5554d55d.dll
Size

818KB
MD5

fbb424daac6c96238d44e80b5554d55d
SHA1

8ec3c03f7e09ecee45e8875d3f2fd7343e3afa84
SHA256

2232571338979c6fe5080b96855fbdc700c6fba0005cbb059770ec9519adfec0
SHA512

37db20bdab2074ede77810396127e1cf1ff69167e3f412f9834d9a61266b90d0281085d978bd6965ae829762093c1cf1013c3d7a35fbaf54e2cd6db40376f3d0
SSDEEP

12288:NdewIvxiRO9n6DPBt9bu8X+L81JcZl1r3x48/2aS4/2YX:NYwIvxFMXn+L8zcZ7rdwC2Y

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1044	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2024	1044	regsvr32.exe	27
PID 1044 wrote to memory of 2024	1044	regsvr32.exe	27
PID 1044 wrote to memory of 2024	1044	regsvr32.exe	27
PID 1044 wrote to memory of 2024	1044	regsvr32.exe	27
PID 1044 wrote to memory of 2024	1044	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fbb424daac6c96238d44e80b5554d55d.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ULZUFkSFhPwSnAWa\DqklI.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2024

memory/1044-54-0x000007FEFB821000-0x000007FEFB823000-memory.dmp

Filesize
8KB

Download
memory/1044-55-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download