emotet | 7a783be0c6885341fd201d96a46cfd365794ca49b5f8447e94a37534cacf71fc

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
09/11/2022, 15:58

Target
file.dll
Size 579KB
Sample221109-tej5tsabb3
SHA256 7a783be0c6885341fd201d96a46cfd365794ca49b5f8447e94a37534cacf71fc
MD5 3bebc96b283f3109dc332e13d38c8bf1
SHA1 7e09d98a7757ebffcfca285fddda32e2615f1511
SHA512 c016d0f5bbed1af9adb3e676904191f537242620dd3ddb6d62ff7bde363358ee4431be66b1a8c2c7b90412716d60c688e1a65f84b454442ae8a9f4f577d71c68
SSDEEP 12288:4xnIaelhGYxP6udmK4Re22fobT3QI+CpTMeNWwgj9Jb:uJ5amKIr2fKT3LTMS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

ecs1.plain

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1184	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 904	1184	regsvr32.exe	27
PID 1184 wrote to memory of 904	1184	regsvr32.exe	27
PID 1184 wrote to memory of 904	1184	regsvr32.exe	27
PID 1184 wrote to memory of 904	1184	regsvr32.exe	27
PID 1184 wrote to memory of 904	1184	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\file.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GihEPSKvNA\qTsBMbWDJB.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:904

memory/1184-54-0x000007FEFB631000-0x000007FEFB633000-memory.dmp

Download

memory/1184-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download