emotet | a1d025cac3a04d2624210ff068ee512e7b288dfdb4d36e051b8d2d2300bcff07

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/11/2022, 21:28

Target
file.dll
Size 516KB
Sample221111-1bcpxaee9w
SHA256 a1d025cac3a04d2624210ff068ee512e7b288dfdb4d36e051b8d2d2300bcff07
MD5 3dc53d732a040d44bcafce62ea3054da
SHA1 11589ddf94a3d84d943108aea11252e190dddafe
SHA512 c90c471c6f2187601df6a481eadfc1f0be16473aaf0b9d2cb51ac9fa235cb43f78bd2c098c32da6d7585ff4a82f5cb889ac662fd4dfe3932fb1287b2c879ebef
SSDEEP 6144:mW1239bnTe+0Qv7NSEBj43USaI6Y/jOpxHRikSYI+QALgIJ1divndEXQn:mW1e9PeexPBjvKSpuvYI+TLgs1dcEXQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1376	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 948	1376	regsvr32.exe	26
PID 1376 wrote to memory of 948	1376	regsvr32.exe	26
PID 1376 wrote to memory of 948	1376	regsvr32.exe	26
PID 1376 wrote to memory of 948	1376	regsvr32.exe	26
PID 1376 wrote to memory of 948	1376	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\file.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ACsPIgoZzqRsaH\iBOtj.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:948

memory/1376-54-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmp

Download

memory/1376-55-0x0000000180000000-0x000000018002E000-memory.dmp

Download