emotet | 68a35608b18a83ea29a9dd55f4c66fa85e8d379cdc30c8b6881f03f33439598a

Analysis

max time kernel
139s
max time network
145s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/11/2022, 17:17

Target
88743fe3d38cf8d93c5bfc3a9e80b5e4.dll
Size 882KB
Sample221104-vtthgsbbar
SHA256 68a35608b18a83ea29a9dd55f4c66fa85e8d379cdc30c8b6881f03f33439598a
MD5 88743fe3d38cf8d93c5bfc3a9e80b5e4
SHA1 fb42a369b25aa7b729cb4ace0657cc24261db1cf
SHA512 d5b370f4256a277d1ff079f3a3ff852f32d8f6481493ca43d6a3e7358c146ff98233972a61884dab05216af896903cfeddba1e1a338683a524e074830aafa18a
SSDEEP 12288:OY67TI+4RcCD01BkNsNi0MBpIwz0WMWQdshDQuxA3:Opk+4Rj01BkN3tphz0WMTmfK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1044	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1444	1044	regsvr32.exe	27
PID 1044 wrote to memory of 1444	1044	regsvr32.exe	27
PID 1044 wrote to memory of 1444	1044	regsvr32.exe	27
PID 1044 wrote to memory of 1444	1044	regsvr32.exe	27
PID 1044 wrote to memory of 1444	1044	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\88743fe3d38cf8d93c5bfc3a9e80b5e4.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ULZUFkSFhPwSnAWa\DqklI.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1444

memory/1044-54-0x000007FEFB821000-0x000007FEFB823000-memory.dmp

Download

memory/1044-55-0x0000000000160000-0x000000000018F000-memory.dmp

Download