emotet | 8c1d88db5b9f8e123deace0a90ce7cd8adc1d03a923eeb4cbda2a0406a1ece9d

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10/11/2022, 15:40

Target
AtNi.dll
Size 621KB
Sample221110-s3715achbl
SHA256 8c1d88db5b9f8e123deace0a90ce7cd8adc1d03a923eeb4cbda2a0406a1ece9d
MD5 9bdbf02aaaf65292441247688263ad0c
SHA1 7be1902670f67475fbbdc9128bbd0d77fc23668a
SHA512 e95dfd7195378cfd6647c8e3a3d30e17950ced3d55649d6456d4cb571815375763503fd97e9c9dfe210cf09793cb2dcd2be80c053d2ed78e074d0160e16b837a
SSDEEP 6144:S6/ptuaN+qWUILr1HRf/9Mu1vHLI7U9XWiygQ30/bP/09Xls9HV6MExbnyDAzlsH:S6/ptu/qerXtU7U9XhZWYobyDAzl+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1764	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 948	1764	regsvr32.exe	28
PID 1764 wrote to memory of 948	1764	regsvr32.exe	28
PID 1764 wrote to memory of 948	1764	regsvr32.exe	28
PID 1764 wrote to memory of 948	1764	regsvr32.exe	28
PID 1764 wrote to memory of 948	1764	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\AtNi.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RyGJd\xSKjOZZwcPine.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:948

memory/1764-54-0x000007FEFBF21000-0x000007FEFBF23000-memory.dmp

Download

memory/1764-55-0x0000000000160000-0x000000000018E000-memory.dmp

Download