emotet | b54fc80227bd242559aa61831a823d549bfb6573a612068d9e6bfa1bea869d96

Analysis

max time kernel
135s
max time network
149s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/11/2022, 10:37

Target
491d3d61b6b217bfac32ad918857f106.dll
Size 413KB
Sample221111-mntbjaef27
SHA256 b54fc80227bd242559aa61831a823d549bfb6573a612068d9e6bfa1bea869d96
MD5 491d3d61b6b217bfac32ad918857f106
SHA1 c1975355c2d650d1ddd8a0d17e5c6d2f779ad8ba
SHA512 f4df77a4e3bbec4239f9ca84b9c66459e6e1a2474a2daf386d0f180fda65f34cf04cc2b2d93309bb81e72a376b9dc8244257970b3beb610294960956c965f5cf
SSDEEP 6144:N/uf2XTixvh7bbWNVbrEqI1z96n9fNgE54zVR71pN:NW+257yMF1zgtGe4z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1768	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1144	1768	regsvr32.exe	27
PID 1768 wrote to memory of 1144	1768	regsvr32.exe	27
PID 1768 wrote to memory of 1144	1768	regsvr32.exe	27
PID 1768 wrote to memory of 1144	1768	regsvr32.exe	27
PID 1768 wrote to memory of 1144	1768	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\491d3d61b6b217bfac32ad918857f106.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\BrWPqiDDIKOIRFx\bxGt.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1144

memory/1768-54-0x000007FEFB621000-0x000007FEFB623000-memory.dmp

Download

memory/1768-55-0x0000000180000000-0x000000018002E000-memory.dmp

Download