emotet | e59c11ed62c813d1c19e02277e14bbeff0312440b4fdc235d3bcbfe1938743b6

Analysis

max time kernel
150s
max time network
157s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
09/11/2022, 21:39

Target
file.dll
Size 575KB
Sample221109-1hlldscda2
SHA256 e59c11ed62c813d1c19e02277e14bbeff0312440b4fdc235d3bcbfe1938743b6
MD5 a856da67745c9910bb6efd1a63755f3b
SHA1 ac5ad5ff7434c1ecbc3c96fcfc530a9f98f64a5e
SHA512 d7dcbc8ec7d8eeedb757508d946f2ddacc5f03a4af3d15e89f9b3fcd275112185c90f4770405d3e6747ac3d46d4f437a97f9f5ed933dfc195974dd6db2c5515c
SSDEEP 12288:OYlfmEB4VCcl00vWcqA+m2GtfopzWmooWXKO3iXHBELq:OAEvWcqA+rGtfE6mWXtiXh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1048	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1784	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1784	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1784	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1784	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1784	1048	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\file.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LHWGNmOJoKGXHALDs\QtpiQhdA.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1784

memory/1048-54-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Download

memory/1048-55-0x0000000180000000-0x000000018002F000-memory.dmp

Download