emotet | 86e698f46d4e50e957e045fac9569bfdc4b8e859ba82f0788c4a40b2e604aa47

Analysis

max time kernel
137s
max time network
151s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/11/2022, 17:53

Target
ed1692d3b0ebc6102b99a454778f69c6.dll
Size 882KB
Sample221104-wgaehsbdbn
SHA256 86e698f46d4e50e957e045fac9569bfdc4b8e859ba82f0788c4a40b2e604aa47
MD5 ed1692d3b0ebc6102b99a454778f69c6
SHA1 486d6849314657ad380d021647cef87a955a211c
SHA512 3e735a2e64ffea8a26dac3f253d9d646dfc065b89c14e03da64c3ca7f20befbee2998f65fb60ff198d2db48126ef1db19ba3dcafed4f15e47699c3ae87d3c4a8
SSDEEP 12288:OY67TI+4RcCD01BkNsNi0MBpIwz0WMWQdshDQPxA3:Opk+4Rj01BkN3tphz0WMTmiK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1724	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2036	1724	regsvr32.exe	27
PID 1724 wrote to memory of 2036	1724	regsvr32.exe	27
PID 1724 wrote to memory of 2036	1724	regsvr32.exe	27
PID 1724 wrote to memory of 2036	1724	regsvr32.exe	27
PID 1724 wrote to memory of 2036	1724	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ed1692d3b0ebc6102b99a454778f69c6.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NWqKXckO\xjnnxTR.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2036

memory/1724-54-0x000007FEFB9E1000-0x000007FEFB9E3000-memory.dmp

Download

memory/1724-55-0x00000000003F0000-0x000000000041F000-memory.dmp

Download