emotet | c842bf6f4efd1513753eb96a4715db648ac23dcdbf38c351f410d3bcbaad5967

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/11/2022, 03:31

Target
bcdc1a6d703d1b04b45f235f3c82c751.dll
Size 585KB
Sample221111-d22qdsagbk
SHA256 c842bf6f4efd1513753eb96a4715db648ac23dcdbf38c351f410d3bcbaad5967
MD5 bcdc1a6d703d1b04b45f235f3c82c751
SHA1 d9b77ea6ca968f9caa602660668eae157af1dfa8
SHA512 94688ed06c34484eacefe0765ae438b0790eed70e752f254d60b6fb51b7dc6451f52f576f061d31e93add12c988fd923ede2a37a79c12429be852b2fb8020aed
SSDEEP 12288:vocAHzfdBuh0PBGEhq6FJxJ/3UEoiMxU:ZAT1BWEtBVUNiMS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
536	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1912	536	regsvr32.exe	27
PID 536 wrote to memory of 1912	536	regsvr32.exe	27
PID 536 wrote to memory of 1912	536	regsvr32.exe	27
PID 536 wrote to memory of 1912	536	regsvr32.exe	27
PID 536 wrote to memory of 1912	536	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bcdc1a6d703d1b04b45f235f3c82c751.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MEUfZbbzVKrGUSCA\WbJcUegmWJI.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1912

memory/536-54-0x000007FEFC4E1000-0x000007FEFC4E3000-memory.dmp

Download

memory/536-55-0x0000000000560000-0x000000000058E000-memory.dmp

Download