emotet | 1ec3cb0967188eb4e48de7c4d2c50dae8da9d475dc5e3ebbb628dc0c263c488d

Analysis

max time kernel
144s
max time network
148s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/11/2022, 03:31

Target
b1624114bc4718114c9b85b192e60585.dll
Size 585KB
Sample221111-d22qdsagbl
SHA256 1ec3cb0967188eb4e48de7c4d2c50dae8da9d475dc5e3ebbb628dc0c263c488d
MD5 b1624114bc4718114c9b85b192e60585
SHA1 63ee102a1953da40c2d86a7bada4d50a61c0b93c
SHA512 362903d57a07606e0b904d54090c297076f8887148aeda6c87bef23249b3b8b24b8ec0d0e9ea63ae27e5930672cc1875d50e7b2bd805aa523595cd2631951992
SSDEEP 12288:vocAHzfdBuh0PBGEhq6FJxJ/3UEoiMxE:ZAT1BWEtBVUNiMK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1760	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1248	1760	regsvr32.exe	28
PID 1760 wrote to memory of 1248	1760	regsvr32.exe	28
PID 1760 wrote to memory of 1248	1760	regsvr32.exe	28
PID 1760 wrote to memory of 1248	1760	regsvr32.exe	28
PID 1760 wrote to memory of 1248	1760	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b1624114bc4718114c9b85b192e60585.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TcNmt\VKEH.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1248

memory/1760-54-0x000007FEFB901000-0x000007FEFB903000-memory.dmp

Download

memory/1760-55-0x0000000000500000-0x000000000052E000-memory.dmp

Download