emotet | 5c620be737e6340bfb3aace334be7c78fe68697dda13dbc8fc99a6cfbf122d0d

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/11/2022, 10:23

Target
946888fdc85777fdfc105f1a5c4a141d.dll
Size 818KB
Sample221104-meszeaecc6
SHA256 5c620be737e6340bfb3aace334be7c78fe68697dda13dbc8fc99a6cfbf122d0d
MD5 946888fdc85777fdfc105f1a5c4a141d
SHA1 d7a68434c3f095e309ed7fc922dfe8f818837b82
SHA512 4bbc08f835f867c8d55900490b20dea8c07451249a23b4f70fe271af0739338e8474ef4dac0ac5c74fdddafc58e6308995311ba47a3958d5b00eeee05a300f6e
SSDEEP 12288:NdewIvxiRO9n6DPBt9bu8X+L81JcZl1rDx48/2aS4/2YX:NYwIvxFMXn+L8zcZ7rJwC2Y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

ecs1.plain

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
864	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 1776	864	regsvr32.exe	28
PID 864 wrote to memory of 1776	864	regsvr32.exe	28
PID 864 wrote to memory of 1776	864	regsvr32.exe	28
PID 864 wrote to memory of 1776	864	regsvr32.exe	28
PID 864 wrote to memory of 1776	864	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\946888fdc85777fdfc105f1a5c4a141d.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\DWIjRaqeBHvj\hbLBeifnAscrm.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1776

memory/864-54-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmp

Download

memory/864-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download