emotet | e1f9d33bde6946be9178e2c4aee493444115e5110756f1ed347229a81bd41dbc

Analysis

max time kernel
145s
max time network
150s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/11/2022, 08:57

Target
dde5033637f5332defe89ef24a34d9e6.dll
Size 818KB
Sample221103-kwk9saagfm
SHA256 e1f9d33bde6946be9178e2c4aee493444115e5110756f1ed347229a81bd41dbc
MD5 dde5033637f5332defe89ef24a34d9e6
SHA1 51207bd87fe88cde67f7f44af31f07a16c2a6b30
SHA512 680978bc16f09cac14ba53ab399907778cc138326b21a4f32e9942eef7ebc280a315b77ec6cf43993741eaa92a11898fc52e575169584314b27c45a81b31f142
SSDEEP 12288:NdewIvxiRO9n6DPBt9bu8X+L81JcZl1rtx48/2aS4/2YX:NYwIvxFMXn+L8zcZ7rPwC2Y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1660	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 980	1660	regsvr32.exe	28
PID 1660 wrote to memory of 980	1660	regsvr32.exe	28
PID 1660 wrote to memory of 980	1660	regsvr32.exe	28
PID 1660 wrote to memory of 980	1660	regsvr32.exe	28
PID 1660 wrote to memory of 980	1660	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dde5033637f5332defe89ef24a34d9e6.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\Kenfqd\ZwfOKCEdRyir.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:980

memory/1660-54-0x000007FEFBCE1000-0x000007FEFBCE3000-memory.dmp

Download

memory/1660-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download