emotet | 05bcaf0a6deee95e6a1ae7d78c373f8065b24be7e614deae9db466d37661387f

Analysis

max time kernel
147s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/11/2022, 02:22

Target
file.dll
Size 585KB
Sample221111-ctl5asgce9
SHA256 05bcaf0a6deee95e6a1ae7d78c373f8065b24be7e614deae9db466d37661387f
MD5 3fde2ed3a80ecde8772f936c357ddf72
SHA1 1b1b103f80cc260da08eca0186d751a7e4f26ad5
SHA512 188f1a35625855da5016efd5c5b862761264f8ef41c3e2ded457dc695bc51c0c0df8593422e2db4c26f9b74f4d817ee3c9eaab1aa56e7c2171218b716007d964
SSDEEP 12288:vocAHzfdBuh0PBGEhq6FJxJ/3UEoiMxB:ZAT1BWEtBVUNiM3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1584	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1648	1584	regsvr32.exe	26
PID 1584 wrote to memory of 1648	1584	regsvr32.exe	26
PID 1584 wrote to memory of 1648	1584	regsvr32.exe	26
PID 1584 wrote to memory of 1648	1584	regsvr32.exe	26
PID 1584 wrote to memory of 1648	1584	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\file.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GELwswOZkeYkFsze\MvcLui.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1648

memory/1584-54-0x000007FEFB7D1000-0x000007FEFB7D3000-memory.dmp

Download

memory/1584-55-0x0000000001C20000-0x0000000001C4E000-memory.dmp

Download