emotet | 7346d6ff99a72c7088f37013a2fe34cdf5c8a327e38836949cc56b43f01338db

Analysis

max time kernel
148s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10/11/2022, 02:03

Target
file.dll
Size 855KB
Sample221110-cgqa7adhb7
SHA256 7346d6ff99a72c7088f37013a2fe34cdf5c8a327e38836949cc56b43f01338db
MD5 9c4c8270ccb781f286f8f752f76fbd25
SHA1 65be056876a0dbf2d645a51487f7a2e77fb23773
SHA512 b6a872d3ab2e3de98a25954b976201bbf0372af27719e1809bd43e42a3a3b9e2e17239b1ac006c8b843dae3ca5c71b8cf963ea5f9ce310a5ff6e8e9a07870eb1
SSDEEP 12288:pDKObx6vnJ/PHpfU1pvqVCf7ZPreSphowXMgjv6qi3/e6hJ/4JsH:Fr+pdM4CTZjX7zMKvU3/dJwq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1480	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 1916	1480	regsvr32.exe	27
PID 1480 wrote to memory of 1916	1480	regsvr32.exe	27
PID 1480 wrote to memory of 1916	1480	regsvr32.exe	27
PID 1480 wrote to memory of 1916	1480	regsvr32.exe	27
PID 1480 wrote to memory of 1916	1480	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\file.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IjxhqX\DThrlS.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1916

memory/1480-54-0x000007FEFB991000-0x000007FEFB993000-memory.dmp

Download

memory/1480-55-0x0000000180000000-0x000000018002F000-memory.dmp

Download