emotet | 78c7bbc53c2da45f2c9856489ad1ed61b528033fe649c5cd6a0a34cd0f527733

Analysis

max time kernel
137s
max time network
145s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/11/2022, 14:08

Target
file.dll
Size 882KB
Sample221104-rfkrmsfhc6
SHA256 78c7bbc53c2da45f2c9856489ad1ed61b528033fe649c5cd6a0a34cd0f527733
MD5 3e91a6a3cf876c4e4b380588b54a5a82
SHA1 0adc21a93887f7ca990cd9be4cb51f22c16b3fbc
SHA512 6a47b277e79bac899a8fe25e26007ede44666e65f62d4f50c07697e3019c6dddb193bfc03ecc71dfa9eaa30325b67da71e4b6966611c6b841b1a2bd34afe82e6
SSDEEP 12288:OY67TI+4RcCD01BkNsNi0MBpIwz0WMWQdshDQzxA3:Opk+4Rj01BkN3tphz0WMTmiK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1960	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1720	1960	regsvr32.exe	26
PID 1960 wrote to memory of 1720	1960	regsvr32.exe	26
PID 1960 wrote to memory of 1720	1960	regsvr32.exe	26
PID 1960 wrote to memory of 1720	1960	regsvr32.exe	26
PID 1960 wrote to memory of 1720	1960	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\file.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WDhtuYntGIvOqzln\HmMLHH.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1720

memory/1960-54-0x000007FEFBD81000-0x000007FEFBD83000-memory.dmp

Download

memory/1960-55-0x0000000001D10000-0x0000000001D3F000-memory.dmp

Download