emotet | 1da01f5d1cb42d0a91eb5405d59f4f7d545e6bfa7f89cecd1191a583e666cd9a

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
09/11/2022, 15:59

Target
file.dll
Size 575KB
Sample221109-te3beabfgm
SHA256 1da01f5d1cb42d0a91eb5405d59f4f7d545e6bfa7f89cecd1191a583e666cd9a
MD5 cb4c02faecb56442577518a88f756a48
SHA1 81474a672efeb9e620b012d2922b2ff067182cab
SHA512 3cb9cb7e56dc137d5b4ccc19b851726726df94a5f447947b1a24e0985f24efce58477d1e00b85c54a404b6d275d89780f58de18316e1ba5170df4f26c4e81f72
SSDEEP 12288:OYlfmEB4VCcl00vWcqA+m2GtfopzWmooWXKO3iXHBELO:OAEvWcqA+rGtfE6mWXtiXh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1464	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 624	1464	regsvr32.exe	26
PID 1464 wrote to memory of 624	1464	regsvr32.exe	26
PID 1464 wrote to memory of 624	1464	regsvr32.exe	26
PID 1464 wrote to memory of 624	1464	regsvr32.exe	26
PID 1464 wrote to memory of 624	1464	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\file.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WScmXXsKHBrAhdBFw\mwlycUb.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624

memory/1464-54-0x000007FEFB5E1000-0x000007FEFB5E3000-memory.dmp

Download

memory/1464-55-0x0000000180000000-0x000000018002F000-memory.dmp

Download