emotet | f68ec69a53130a24b0fe53d1d1fe70992d86a6d67006ae45f986f9ef4f450b6c

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13/11/2022, 06:26

Target
ae1747c930e9e4f45fbc970a83b52284.dll
Size 516KB
Sample221113-g67c8aaf47
SHA256 f68ec69a53130a24b0fe53d1d1fe70992d86a6d67006ae45f986f9ef4f450b6c
MD5 ae1747c930e9e4f45fbc970a83b52284
SHA1 638cde28bbe3cfe7b53aa75a7cf6991baa692a4a
SHA512 ca21c036710b526fb1841232461f12bab05422ee870ca8faaea16e032bf61a7bc204196999830f704782cc784c51fe2cc58f0059e5df9bfa9a4d3b668be430c4
SSDEEP 6144:mW1239bnTe+0Qv7NSEBj43USaI6Y/jOpxHRikSYI+QALgIJ1divndEXPn:mW1e9PeexPBjvKSpuvYI+TLgs1dcEXP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1504	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1220	1504	regsvr32.exe	27
PID 1504 wrote to memory of 1220	1504	regsvr32.exe	27
PID 1504 wrote to memory of 1220	1504	regsvr32.exe	27
PID 1504 wrote to memory of 1220	1504	regsvr32.exe	27
PID 1504 wrote to memory of 1220	1504	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ae1747c930e9e4f45fbc970a83b52284.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IArgZHsnhIOEUeQC\MpiqFKArna.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1220

memory/1504-54-0x000007FEFC291000-0x000007FEFC293000-memory.dmp

Download

memory/1504-55-0x0000000180000000-0x000000018002E000-memory.dmp

Download