emotet | 697d5623de74c08e8c1d2ed52228afc7b553257a4c058ef049490cb4b47cdf93

Analysis

max time kernel
151s
max time network
184s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09/11/2022, 01:56

Target
a47191e9ef10cd8612863807e1e947be.dll
Size 581KB
Sample221109-ccph4aeegl
SHA256 697d5623de74c08e8c1d2ed52228afc7b553257a4c058ef049490cb4b47cdf93
MD5 a47191e9ef10cd8612863807e1e947be
SHA1 5241fe7efe58b8430ef12f158ef7ca02d646fb4d
SHA512 613c0f67f7d222a08ebdcce23db0a4061f74e6b61fa7d047fe7101045a32f0c934536ec787b440db74ca831c3cf401db89f082ceacddae0fbe5bf1961c6f99c6
SSDEEP 12288:M9an1kT4VCclzX/m8qAOmhmd+oiCh1CbSeQVuFvnCcaL:MoF/m8qAOcmd+LCXvRVu9nO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

ecs1.plain

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1536	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 1148	1536	regsvr32.exe	27
PID 1536 wrote to memory of 1148	1536	regsvr32.exe	27
PID 1536 wrote to memory of 1148	1536	regsvr32.exe	27
PID 1536 wrote to memory of 1148	1536	regsvr32.exe	27
PID 1536 wrote to memory of 1148	1536	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a47191e9ef10cd8612863807e1e947be.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\QQiYqvsI\yxoskMVujGdqvto.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1148

memory/1536-54-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

Download

memory/1536-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download