emotet | 08a2413598b3baf793ffa58364e88aff9fd7e9356f5142427816a526809db3dc

Analysis

max time kernel
145s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/11/2022, 12:35

Target

426b40afb3877e199f66f5af9fd6101d.dll
Size

814KB
MD5

426b40afb3877e199f66f5af9fd6101d
SHA1

b17ada54e9d4d5a3307727c2104a6ceeccac0fe5
SHA256

08a2413598b3baf793ffa58364e88aff9fd7e9356f5142427816a526809db3dc
SHA512

009f66a68e04e516ef5cc44fde191c5ed9b8e7aa88ee3804fd3f490fb01c3808d765e41a4a86be96fa32c7a8454b75e24f26a674a2ee567ef67ca3f0ff6bbe15
SSDEEP

12288:5sIyzbpudwh9PQx873eHeLs15pZ6yRQbf04Tn/WMideaik:5JyzbwdG4eLsjpZfRQ//q8fk

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
364	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1704	364	regsvr32.exe	26
PID 364 wrote to memory of 1704	364	regsvr32.exe	26
PID 364 wrote to memory of 1704	364	regsvr32.exe	26
PID 364 wrote to memory of 1704	364	regsvr32.exe	26
PID 364 wrote to memory of 1704	364	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\426b40afb3877e199f66f5af9fd6101d.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JAxhz\RWXZXyF.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1704

memory/364-54-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmp

Filesize
8KB

Download
memory/364-55-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download