emotet | 2de51cc19cc9ddc6167e34f8038fadb10a207bfacf8ad51d8cd6b45dbb00969e

Analysis

max time kernel
142s
max time network
148s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09/11/2022, 15:55

Target
file.dll
Size 579KB
Sample221109-tcsdesbfel
SHA256 2de51cc19cc9ddc6167e34f8038fadb10a207bfacf8ad51d8cd6b45dbb00969e
MD5 249da84fab7f4728ec0c2fb066939cbd
SHA1 b043afa3053517fe97799ff3aa396296251e30a1
SHA512 6ed265e9eeda168e73d067e170fd837404a788d6c653d6393e284850839068633bd83b2a9c576d8003418919238c4c66940c6ed0ada2320af8121eb30efdcfaf
SSDEEP 12288:4xnIaelhGYxP6udmK4Re22fobT3QI+CpTMeNWwgi9Jb:uJ5amKIr2fKT3LTMS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

ecs1.plain

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1112	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1716	1112	regsvr32.exe	28
PID 1112 wrote to memory of 1716	1112	regsvr32.exe	28
PID 1112 wrote to memory of 1716	1112	regsvr32.exe	28
PID 1112 wrote to memory of 1716	1112	regsvr32.exe	28
PID 1112 wrote to memory of 1716	1112	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\file.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ACghvVEnp\hhZaf.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1716

memory/1112-54-0x000007FEFB801000-0x000007FEFB803000-memory.dmp

Download

memory/1112-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download