emotet | 6c19c2b5ba5e03acdcc8395804334d6176ef9f0c1ded120ebdbbae251f225099

Analysis

max time kernel
141s
max time network
148s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10/11/2022, 02:17

Target
file.dll
Size 591KB
Sample221110-cqqcjsfgbl
SHA256 6c19c2b5ba5e03acdcc8395804334d6176ef9f0c1ded120ebdbbae251f225099
MD5 2455b693ba7b67be8c69424632aa1add
SHA1 5b94f3be795f2498db75532092e570338223972e
SHA512 3173677c09c9c7beac866553bfb422cfd4e8af54799cb8e750f029fe4b19c937eeef774b3215b1e0646449ffd049afd30b0e043141cf82e543fe3e99d9a8e5a3
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfmw1L:1ml8U52n1pkxoI0nwfmm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

ecs1.plain

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
584	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 584 wrote to memory of 880	584	regsvr32.exe	28
PID 584 wrote to memory of 880	584	regsvr32.exe	28
PID 584 wrote to memory of 880	584	regsvr32.exe	28
PID 584 wrote to memory of 880	584	regsvr32.exe	28
PID 584 wrote to memory of 880	584	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\file.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:584
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XWGmKA\mutUhHdtVCN.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:880

memory/584-54-0x000007FEFBC61000-0x000007FEFBC63000-memory.dmp

Download

memory/584-55-0x0000000001D40000-0x0000000001D70000-memory.dmp

Download