emotet | d50cb44538dff912592611fcbd6e010419cc2ebdcc31d0b63d71cf230fec478c

Analysis

max time kernel
149s
max time network
157s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
09/11/2022, 03:48

Target
b5cd45a9b965900082549d8db4a6f7d5.dll
Size 570KB
Sample221109-ecth6adeb3
SHA256 d50cb44538dff912592611fcbd6e010419cc2ebdcc31d0b63d71cf230fec478c
MD5 b5cd45a9b965900082549d8db4a6f7d5
SHA1 bbcb97aa7c6fffa557769972c6a64d36e28f9b5a
SHA512 7f284bc487cffbc94fb3e158309419652ddf72092d6427e99b34355c2c07bb258de2ab7e76f5b19237008bac2d8ecc3e5d5c8713d47dfb57dd8c112047454e0f
SSDEEP 12288:V2nPUlhGYxfKesOd46kYQ9oY1Ewhax7uLVG2c79QWiDQFAJHs:V2PX7OdHPQ97bhaSG2c76WiM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

ecs1.plain

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1204	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1736	1204	regsvr32.exe	27
PID 1204 wrote to memory of 1736	1204	regsvr32.exe	27
PID 1204 wrote to memory of 1736	1204	regsvr32.exe	27
PID 1204 wrote to memory of 1736	1204	regsvr32.exe	27
PID 1204 wrote to memory of 1736	1204	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b5cd45a9b965900082549d8db4a6f7d5.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XdtXHWT\xCmnRVddfgVg.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1736

memory/1204-54-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Download

memory/1204-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download