emotet | 6f751bd90bf36a5197f6cf91bb533963076bce5f7c7577c519d4bf573c304a18

Analysis

max time kernel
143s
max time network
150s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/11/2022, 08:57

Target
87fdbba19c131e74fbe2f98b135751d5.dll
Size 814KB
Sample221103-kwk9saagfn
SHA256 6f751bd90bf36a5197f6cf91bb533963076bce5f7c7577c519d4bf573c304a18
MD5 87fdbba19c131e74fbe2f98b135751d5
SHA1 ebc4f91f52156d65d21ab0fba1d7fd5f9d03f011
SHA512 fabc6342d72e136d35c3161f72292850fef46073a33dbe71989d8f198763ddf8be4fd7a0017fde03fbf10278537ac7933de034335b3ccf33c246da52d705b2f1
SSDEEP 12288:5sIyzbpudwh9PQx873eHeLs15pZ6yRQbf04Tn/WMideaik:5JyzbwdG4eLsjpZfRQ//q8fk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1112	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 900	1112	regsvr32.exe	28
PID 1112 wrote to memory of 900	1112	regsvr32.exe	28
PID 1112 wrote to memory of 900	1112	regsvr32.exe	28
PID 1112 wrote to memory of 900	1112	regsvr32.exe	28
PID 1112 wrote to memory of 900	1112	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\87fdbba19c131e74fbe2f98b135751d5.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TRhebVGAaHiYEoio\MOcoAL.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:900

memory/1112-54-0x000007FEFB801000-0x000007FEFB803000-memory.dmp

Download

memory/1112-55-0x0000000180000000-0x000000018002F000-memory.dmp

Download