emotet | f32c62fcf1c19aa93529975195dea9ba17e513a4070f653077ce876a6343acc7

Analysis

max time kernel
139s
max time network
147s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/11/2022, 02:19

Target
file.dll
Size 585KB
Sample221111-crvcwsacgn
SHA256 f32c62fcf1c19aa93529975195dea9ba17e513a4070f653077ce876a6343acc7
MD5 a0bd2f34cb3e358cea53678e89e2bc14
SHA1 013db6d46f4e4b7b2fa8be3e25d64d7e971a516b
SHA512 a369321b9a87337acf4d986564e802f73bcfe5e814672e59b9c56975307ca998f1536138c35743488d74018631ec1003dbd0db589ab42b6cf8f04397d84f7828
SSDEEP 12288:vocAHzfdBuh0PBGEhq6FJxJ/3UEoiMx8:ZAT1BWEtBVUNiMW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1256	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 1216	1256	regsvr32.exe	26
PID 1256 wrote to memory of 1216	1256	regsvr32.exe	26
PID 1256 wrote to memory of 1216	1256	regsvr32.exe	26
PID 1256 wrote to memory of 1216	1256	regsvr32.exe	26
PID 1256 wrote to memory of 1216	1256	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\file.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ACsPIgoZzqRsaH\iBOtj.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1216

memory/1256-54-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmp

Download

memory/1256-55-0x00000000004F0000-0x000000000051E000-memory.dmp

Download