emotet | 7ccd10c9787778b3ab52fe7ea3c121fd3ef817993e1bfbad34bbc58a8990adc6

Analysis

max time kernel
145s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/11/2022, 17:17

Target
c2bc2eeb9fdf2dec81f5b884287752a0.dll
Size 882KB
Sample221104-vtthgshbb5
SHA256 7ccd10c9787778b3ab52fe7ea3c121fd3ef817993e1bfbad34bbc58a8990adc6
MD5 c2bc2eeb9fdf2dec81f5b884287752a0
SHA1 9817207eee2d9d2a61e822c56d7e2900faa10eaf
SHA512 fd5b9fba73b3c2ee856fa577d0ae2d0fb02b092545aed5d0b8d961a904da03633157cd5cd2d7a6c6d3947f8897c62362f143ae80fa35eb1597eab6871b9b6936
SSDEEP 12288:OY67TI+4RcCD01BkNsNi0MBpIwz0WMWQdshDQaxA3:Opk+4Rj01BkN3tphz0WMTmfK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
864	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 1520	864	regsvr32.exe	27
PID 864 wrote to memory of 1520	864	regsvr32.exe	27
PID 864 wrote to memory of 1520	864	regsvr32.exe	27
PID 864 wrote to memory of 1520	864	regsvr32.exe	27
PID 864 wrote to memory of 1520	864	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c2bc2eeb9fdf2dec81f5b884287752a0.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YwmcAnOSHpZogeFb\OqcpVCqkjGbUPSG.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1520

memory/864-54-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Download

memory/864-55-0x00000000005D0000-0x00000000005FF000-memory.dmp

Download