emotet | d9a312616aa763fa4579a71c33bd71bba4eb2b935db49a64654806d0c30cb67d

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/11/2022, 14:10

Target
file.dll
Size 882KB
Sample221104-rgratafhe3
SHA256 d9a312616aa763fa4579a71c33bd71bba4eb2b935db49a64654806d0c30cb67d
MD5 bd532fd0d4af4b54e4ec602d9d191184
SHA1 0da6311bd1f9e4205b9c0a4142839d2fcd82783b
SHA512 1eeacec6bc9c96222881d15f8d21fd8de483ffbcfe474442cd1606e5b656d408688bb66857f0a670dd42560c6e12b9db96e097999111e3b37df78ab573417f6e
SSDEEP 12288:OY67TI+4RcCD01BkNsNi0MBpIwz0WMWQdshDQnxA3:Opk+4Rj01BkN3tphz0WMTm+K
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
864	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 1776	864	regsvr32.exe	28
PID 864 wrote to memory of 1776	864	regsvr32.exe	28
PID 864 wrote to memory of 1776	864	regsvr32.exe	28
PID 864 wrote to memory of 1776	864	regsvr32.exe	28
PID 864 wrote to memory of 1776	864	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\file.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\EVTVtigOztP\OaMcyO.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1776

memory/864-54-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmp

Download

memory/864-55-0x00000000003E0000-0x000000000040F000-memory.dmp

Download