emotet | 9542bed448d41d81105a7e2ee4e664e77becf6a94dc34750b30729eba18408ed

Analysis

max time kernel
144s
max time network
149s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13/11/2022, 15:24

Target
91c432979e71a6ef51b57d474f504397.dll
Size 413KB
Sample221113-ss3nnaef9w
SHA256 9542bed448d41d81105a7e2ee4e664e77becf6a94dc34750b30729eba18408ed
MD5 91c432979e71a6ef51b57d474f504397
SHA1 cc371591fa4365a74414b7e2fe03481d2bd01252
SHA512 f18926ba694bcd91bda073e7108b23fa80650ad02b6699fd98fd8ff284b11152ae163e3a58473d59d0f7f619ba28a65b7e4f6a48134fd7030f250b8fdf19d419
SSDEEP 6144:N/uf2XTixvh7bbWNVbrEqI1z96n9fNgE54zVR71p9:NW+257yMF1zgtGe4z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
532	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 1180	532	regsvr32.exe	27
PID 532 wrote to memory of 1180	532	regsvr32.exe	27
PID 532 wrote to memory of 1180	532	regsvr32.exe	27
PID 532 wrote to memory of 1180	532	regsvr32.exe	27
PID 532 wrote to memory of 1180	532	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\91c432979e71a6ef51b57d474f504397.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ScwHyADpljlx\PlXjRvmt.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1180

memory/532-54-0x000007FEFB751000-0x000007FEFB753000-memory.dmp

Download

memory/532-55-0x0000000180000000-0x000000018002E000-memory.dmp

Download