emotet | a52b8ad645887dd20eb2ee183f4630213aa7eb25d7402f0057d27c11a110a0a0

Analysis

max time kernel
178s
max time network
193s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09/11/2022, 11:32

Target
97f08c0a40a251cb2997d814f0a004a2.dll
Size 579KB
Sample221109-nnapvsgec8
SHA256 a52b8ad645887dd20eb2ee183f4630213aa7eb25d7402f0057d27c11a110a0a0
MD5 97f08c0a40a251cb2997d814f0a004a2
SHA1 1d75fbcde526e7ab77f494717572f44fb6289367
SHA512 1778a4ed428e1bdaf7e6bc46c20b32df8d064cdfd3977e56b8bb52fdb1d11bd9db77689b507f76ccc521d4783136bfab22da06a95fd1940bf6f17c91097da31c
SSDEEP 12288:4xnIaelhGYxP6udmK4Re22fobT3QI+CpTMeNWwgx9Jb:uJ5amKIr2fKT3LTMS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

ecs1.plain

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1724	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 840	1724	regsvr32.exe	28
PID 1724 wrote to memory of 840	1724	regsvr32.exe	28
PID 1724 wrote to memory of 840	1724	regsvr32.exe	28
PID 1724 wrote to memory of 840	1724	regsvr32.exe	28
PID 1724 wrote to memory of 840	1724	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\97f08c0a40a251cb2997d814f0a004a2.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\QyhHzyiUc\NzCVxBvXXwft.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:840

memory/1724-54-0x000007FEFBFE1000-0x000007FEFBFE3000-memory.dmp

Download

memory/1724-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download