emotet | af261d658cd3c5ac111fe05ca3da546ec0650e4098aec432421d1a31558d9a2d

Analysis

max time kernel
147s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/11/2022, 10:35

Target
9c78faf32a8df201a44cf6b4257370a5.dll
Size 413KB
Sample221111-mmrrbaef22
SHA256 af261d658cd3c5ac111fe05ca3da546ec0650e4098aec432421d1a31558d9a2d
MD5 9c78faf32a8df201a44cf6b4257370a5
SHA1 27faf9b6c2d1c0d5c64207fafa4b97e0782556d0
SHA512 4a080026db204bfa573d3c3fee45097e4850e8dc02d67c0a1b95735bb20b83d291d0b5a3406e35d56c5181b759b738eb5fdb696ed959fc08d0b0c2cefa0f545e
SSDEEP 6144:N/uf2XTixvh7bbWNVbrEqI1z96n9fNgE54zVR71pG:NW+257yMF1zgtGe4z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1076	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 336	1076	regsvr32.exe	28
PID 1076 wrote to memory of 336	1076	regsvr32.exe	28
PID 1076 wrote to memory of 336	1076	regsvr32.exe	28
PID 1076 wrote to memory of 336	1076	regsvr32.exe	28
PID 1076 wrote to memory of 336	1076	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9c78faf32a8df201a44cf6b4257370a5.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TcNmt\VKEH.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:336

memory/1076-54-0x000007FEFB901000-0x000007FEFB903000-memory.dmp

Download

memory/1076-55-0x0000000180000000-0x000000018002E000-memory.dmp

Download