emotet | 34e196710709c6ae2352afbef328de114f8d7d4d48ebc680a8b0afbe05580827

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/11/2022, 05:13

Target
2aff5f1d8dc17b0beafcd08c463aeb00.dll
Size 585KB
Sample221111-fwepsabcgp
SHA256 34e196710709c6ae2352afbef328de114f8d7d4d48ebc680a8b0afbe05580827
MD5 2aff5f1d8dc17b0beafcd08c463aeb00
SHA1 489cb1f65b4782f401e854f06213d34a7b150c28
SHA512 e0387d1a546a59f669859e71b3bdf6fcb947a18a182ce0e2fc57cadc913eed54a4715897cb716ff6ca484d2bd43fbc20577282e1df590beabb343d00fd7b7858
SSDEEP 12288:vocAHzfdBuh0PBGEhq6FJxJ/3UEoiMxe:ZAT1BWEtBVUNiMg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1464	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 624	1464	regsvr32.exe	26
PID 1464 wrote to memory of 624	1464	regsvr32.exe	26
PID 1464 wrote to memory of 624	1464	regsvr32.exe	26
PID 1464 wrote to memory of 624	1464	regsvr32.exe	26
PID 1464 wrote to memory of 624	1464	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2aff5f1d8dc17b0beafcd08c463aeb00.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WScmXXsKHBrAhdBFw\mwlycUb.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624

memory/1464-54-0x000007FEFB5E1000-0x000007FEFB5E3000-memory.dmp

Download

memory/1464-55-0x00000000001E0000-0x000000000020E000-memory.dmp

Download