emotet | b772d64952b336cf1cefc8bf5ee4115a8982a97a299b7ecec3a9825a190875fd

Analysis

max time kernel
146s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/11/2022, 02:19

Target
file.dll
Size 585KB
Sample221111-crvcwsacgp
SHA256 b772d64952b336cf1cefc8bf5ee4115a8982a97a299b7ecec3a9825a190875fd
MD5 ff86656b41b54ac1a4c1cafccff4235b
SHA1 85def311b3ec279cbd193cb0ca1d78f613f4f9c1
SHA512 87acfc47dd876892dae01e3ab3f10cec834931baa755f41e92ff9cae2be7d40f8749b8a3cce785360dd46dd57ec5b711d1f9d081934fa3f8efa08c2016800e79
SSDEEP 12288:vocAHzfdBuh0PBGEhq6FJxJ/3UEoiMxo:ZAT1BWEtBVUNiMq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1980	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 856	1980	regsvr32.exe	28
PID 1980 wrote to memory of 856	1980	regsvr32.exe	28
PID 1980 wrote to memory of 856	1980	regsvr32.exe	28
PID 1980 wrote to memory of 856	1980	regsvr32.exe	28
PID 1980 wrote to memory of 856	1980	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\file.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FtnGSxuVAZEaCo\gGNVmochprm.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:856

memory/1980-54-0x000007FEFC1B1000-0x000007FEFC1B3000-memory.dmp

Download

memory/1980-55-0x0000000000160000-0x000000000018E000-memory.dmp

Download