emotet | 7513f85302773bd6594913624972009effc0f9a88f3e267518e83dcb181753af

Analysis

max time kernel
202s
max time network
211s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09/11/2022, 11:30

Target
14367817a1967cfe9d9e41ea42173a47.dll
Size 579KB
Sample221109-nl53zsaagk
SHA256 7513f85302773bd6594913624972009effc0f9a88f3e267518e83dcb181753af
MD5 14367817a1967cfe9d9e41ea42173a47
SHA1 a4c0f8d8f5bd226fc3969c8c359448ed80db1400
SHA512 8abb0b96c82f4fe70d6c21166ff73a67e9ce8523387a2fe2aeffc177aebb7a44afac2fb2fb5f19ee448fd13fb5ab9b767fb9afabe13f506094e81cf9f16da043
SSDEEP 12288:4xnIaelhGYxP6udmK4Re22fobT3QI+CpTMeNWwgb9Jb:uJ5amKIr2fKT3LTMS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

ecs1.plain

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
896	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 1112	896	regsvr32.exe	27
PID 896 wrote to memory of 1112	896	regsvr32.exe	27
PID 896 wrote to memory of 1112	896	regsvr32.exe	27
PID 896 wrote to memory of 1112	896	regsvr32.exe	27
PID 896 wrote to memory of 1112	896	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\14367817a1967cfe9d9e41ea42173a47.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JwTBQQtXG\WZrNogRpKOFIujg.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1112

memory/896-54-0x000007FEFC341000-0x000007FEFC343000-memory.dmp

Download

memory/896-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download