emotet | 46745061dfffc093506b01b38ff58d832d0357926e6fcdbd3d72f3ba2f2f2cd2

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13/11/2022, 15:22

Target
70a91f3abfdcbb8c4d517cd2249b2037.dll
Size 516KB
Sample221113-srxe9abe34
SHA256 46745061dfffc093506b01b38ff58d832d0357926e6fcdbd3d72f3ba2f2f2cd2
MD5 70a91f3abfdcbb8c4d517cd2249b2037
SHA1 563cbbb6d22a99956c06981a12e238daf8b33eba
SHA512 8dfe60ad7385811685ed9b16816e85f946505575faeee899aae1e5eac991d05ab6f62830de2e597cc00dd0dce12ad6e9464d82be1e7c8d291a64db36e4c60aa2
SSDEEP 6144:mW1239bnTe+0Qv7NSEBj43USaI6Y/jOpxHRikSYI+QALgIJ1divndEXYn:mW1e9PeexPBjvKSpuvYI+TLgs1dcEXY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1648	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1264	1648	regsvr32.exe	28
PID 1648 wrote to memory of 1264	1648	regsvr32.exe	28
PID 1648 wrote to memory of 1264	1648	regsvr32.exe	28
PID 1648 wrote to memory of 1264	1648	regsvr32.exe	28
PID 1648 wrote to memory of 1264	1648	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\70a91f3abfdcbb8c4d517cd2249b2037.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\CSUBIbLXDIQgQHQmz\msUg.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1264

memory/1648-54-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Download

memory/1648-55-0x0000000180000000-0x000000018002E000-memory.dmp

Download