emotet | 0afd01eaa1c6f4a17117a60c671e730ee5aff78ff3fc75796978f6a1fb6cee81

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/11/2022, 05:15

Target
ff50ddabe1f0591275ce632268f46811.dll
Size 585KB
Sample221111-fxkmesbdaj
SHA256 0afd01eaa1c6f4a17117a60c671e730ee5aff78ff3fc75796978f6a1fb6cee81
MD5 ff50ddabe1f0591275ce632268f46811
SHA1 20544e3d958617578907fcc152d15a8ffd629c5e
SHA512 2b2d3b90f84ad9aef9570c8ad2922a52007e73b00bb820f725927cb0e3c51d9e1547f2fd0e5eb174e7e91eaa7f088b1cf61f6c6d7bf092039b23d00534303eba
SSDEEP 12288:vocAHzfdBuh0PBGEhq6FJxJ/3UEoiMxP:ZAT1BWEtBVUNiMh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
832	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 2040	832	regsvr32.exe	28
PID 832 wrote to memory of 2040	832	regsvr32.exe	28
PID 832 wrote to memory of 2040	832	regsvr32.exe	28
PID 832 wrote to memory of 2040	832	regsvr32.exe	28
PID 832 wrote to memory of 2040	832	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ff50ddabe1f0591275ce632268f46811.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WawehaeGZAITfkTMS\CyPqvdsZzhUisxSI.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2040

memory/832-54-0x000007FEFC611000-0x000007FEFC613000-memory.dmp

Download

memory/832-55-0x0000000001D30000-0x0000000001D5E000-memory.dmp

Download