emotet | 7a4a9430c0426c722deddfca58e247b4f1a1509f2407c2be79b61e40f9f8d28c

Analysis

max time kernel
147s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-11-2022 09:20

Target

febbefc88148ad51fba563af8c257a47.dll
Size

818KB
MD5

febbefc88148ad51fba563af8c257a47
SHA1

9f50915e234d7150766ba4dd5b86dfbcdaaccefc
SHA256

7a4a9430c0426c722deddfca58e247b4f1a1509f2407c2be79b61e40f9f8d28c
SHA512

384f63107dbfc68c67f42b4f7458978ad93277abc2ee14a8b88470cee1b4ea8874c86a359e20ecef523a7bfefdbb4f8708d344a2e38f98e6b584ae777bf3b0bb
SSDEEP

12288:NdewIvxiRO9n6DPBt9bu8X+L81JcZl1r9x48/2aS4/2YX:NYwIvxFMXn+L8zcZ7rfwC2Y

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1424	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 1344	1424	regsvr32.exe	26
PID 1424 wrote to memory of 1344	1424	regsvr32.exe	26
PID 1424 wrote to memory of 1344	1424	regsvr32.exe	26
PID 1424 wrote to memory of 1344	1424	regsvr32.exe	26
PID 1424 wrote to memory of 1344	1424	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\febbefc88148ad51fba563af8c257a47.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GjwklzXCUlSTjyuiI\GVJqRoaMxhV.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1344

memory/1344-58-0x0000000000000000-mapping.dmp

Download
memory/1424-54-0x000007FEFBD11000-0x000007FEFBD13000-memory.dmp

Filesize
8KB

Download
memory/1424-55-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download