emotet | a7a9ebbab10c602d25b497eedbb63bb30328ad27619bbfc3173c97e2345836d9

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/11/2022, 02:22

Target
file.dll
Size 585KB
Sample221111-ctl5asgcf2
SHA256 a7a9ebbab10c602d25b497eedbb63bb30328ad27619bbfc3173c97e2345836d9
MD5 f45cfc1601cee6608cad7f4b369df4ae
SHA1 925a690ef7f22a2089186b73782c0f2ff238ff39
SHA512 110ef89bf187937668194959edf0af46e1bd8130855f089b065c93cb08692debbfa0ea2ebe7456cae1ec5cb705d4313a764db7337712943a4df01f722405a44d
SSDEEP 12288:vocAHzfdBuh0PBGEhq6FJxJ/3UEoiMxQ:ZAT1BWEtBVUNiMW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1652	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 948	1652	regsvr32.exe	28
PID 1652 wrote to memory of 948	1652	regsvr32.exe	28
PID 1652 wrote to memory of 948	1652	regsvr32.exe	28
PID 1652 wrote to memory of 948	1652	regsvr32.exe	28
PID 1652 wrote to memory of 948	1652	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\file.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WsEWtHq\UoqDMSfkWaglGtZw.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:948

memory/1652-54-0x000007FEFBB81000-0x000007FEFBB83000-memory.dmp

Download

memory/1652-55-0x0000000001E80000-0x0000000001EAE000-memory.dmp

Download