emotet | a6a18799567b0d93dbdafa03cc91f594a98e6e47b4e19755881e9ca0aefc5a72

Analysis

max time kernel
148s
max time network
154s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
09/11/2022, 02:37

Target
PKr3guYSxz6FCzNfTR.dll
Size 570KB
Sample221109-c35yrsdbc6
SHA256 a6a18799567b0d93dbdafa03cc91f594a98e6e47b4e19755881e9ca0aefc5a72
MD5 fc2c6faebcfb57cd9155c66788538516
SHA1 a9e947bdb501bfe51d9bf1338131d7162bed9455
SHA512 4f3195fbdfb8c18a68000f2ae2242e986a3b7439e18ae99907efb8c227e7522e3de1163592727bf59b26b2eab0b85e20e752c351ac14a8ef7f64c2952e69db9a
SSDEEP 12288:V2nPUlhGYxfKesOd46kYQ9oY1Ewhax7uLVG2c79QWiDQFA0Hs:V2PX7OdHPQ97bhaSG2c76WiM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

ecs1.plain

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1448	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 320	1448	regsvr32.exe	27
PID 1448 wrote to memory of 320	1448	regsvr32.exe	27
PID 1448 wrote to memory of 320	1448	regsvr32.exe	27
PID 1448 wrote to memory of 320	1448	regsvr32.exe	27
PID 1448 wrote to memory of 320	1448	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\PKr3guYSxz6FCzNfTR.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\EpEFNBPZoOyUo\iDvlEkLKfVZw.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:320

memory/1448-54-0x000007FEFB9E1000-0x000007FEFB9E3000-memory.dmp

Download

memory/1448-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download