emotet | 5b2a6a3ab952ebd6502fca0ab4a902e5982890040625de9359d7b7754b5337c0

Analysis

max time kernel
144s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/11/2022, 14:32

Target

a749296efb9290da3d134fea8df4b272.dll
Size

818KB
MD5

a749296efb9290da3d134fea8df4b272
SHA1

2b84d4c985e1a54a3e1b34cfcf44341bf110bcc8
SHA256

5b2a6a3ab952ebd6502fca0ab4a902e5982890040625de9359d7b7754b5337c0
SHA512

461d32e6a5a2091124b0cdf22de9be017344ed3ec3ba336bfeba3b3f90bc8dc70b56035e5112c93c5937951c91ac284419be59eecb58b1c3ef8e416e797aad56
SSDEEP

12288:NdewIvxiRO9n6DPBt9bu8X+L81JcZl1r/x48/2aS4/2YX:NYwIvxFMXn+L8zcZ7rFwC2Y

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1452	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 1612	1452	regsvr32.exe	26
PID 1452 wrote to memory of 1612	1452	regsvr32.exe	26
PID 1452 wrote to memory of 1612	1452	regsvr32.exe	26
PID 1452 wrote to memory of 1612	1452	regsvr32.exe	26
PID 1452 wrote to memory of 1612	1452	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a749296efb9290da3d134fea8df4b272.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\THYWYzFjExrDytkyN\Eour.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1612

memory/1452-54-0x000007FEFBC61000-0x000007FEFBC63000-memory.dmp

Filesize
8KB

Download
memory/1452-55-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download