emotet | f60b2f61270b976d9e020158cc84a51da321b3e0dda9f1607db01bf13c71e5c5

Analysis

max time kernel
143s
max time network
149s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/11/2022, 02:19

Target
file.dll
Size 585KB
Sample221111-crvcwsgce2
SHA256 f60b2f61270b976d9e020158cc84a51da321b3e0dda9f1607db01bf13c71e5c5
MD5 865f15ec1db2adeef2f1616b54686b2c
SHA1 2dc7454c60f48e6cb80d82be20956f8782a1af0d
SHA512 e3d5ddf9605768a8585f69dd6af6bcfa605c1f9977b4527e0dcb4b4c252cf5424336796e0c7c3faa551a8d119414e86ba8cf72d117a62e83eb73ad12410eb557
SSDEEP 12288:vocAHzfdBuh0PBGEhq6FJxJ/3UEoiMxH:ZAT1BWEtBVUNiMx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
536	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1912	536	regsvr32.exe	27
PID 536 wrote to memory of 1912	536	regsvr32.exe	27
PID 536 wrote to memory of 1912	536	regsvr32.exe	27
PID 536 wrote to memory of 1912	536	regsvr32.exe	27
PID 536 wrote to memory of 1912	536	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\file.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MEUfZbbzVKrGUSCA\WbJcUegmWJI.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1912

memory/536-54-0x000007FEFC4E1000-0x000007FEFC4E3000-memory.dmp

Download

memory/536-55-0x00000000001F0000-0x000000000021E000-memory.dmp

Download