emotet | 1ec95b1895a4091d055e33d064d4ffcf16a030c19bf1e208451e6a813c65dfe0

Analysis

max time kernel
136s
max time network
144s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
13/11/2022, 15:23

Target
b4dfee961b77fce87e1f534d34d657b1.dll
Size 516KB
Sample221113-ssgfesbe39
SHA256 1ec95b1895a4091d055e33d064d4ffcf16a030c19bf1e208451e6a813c65dfe0
MD5 b4dfee961b77fce87e1f534d34d657b1
SHA1 4e6de451cf20fb2288baa11ed1c40d5e905d80ac
SHA512 da83b0abe1245e82e8b663679d5bfea338af45f3f6107f6622a6335af3d36c75c442ce9919d7f85043745212d5610eec5d1bc2590d8c094444a7ab3ba99778c3
SSDEEP 6144:mW1239bnTe+0Qv7NSEBj43USaI6Y/jOpxHRikSYI+QALgIJ1divndEX/n:mW1e9PeexPBjvKSpuvYI+TLgs1dcEX/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1292	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 1776	1292	regsvr32.exe	27
PID 1292 wrote to memory of 1776	1292	regsvr32.exe	27
PID 1292 wrote to memory of 1776	1292	regsvr32.exe	27
PID 1292 wrote to memory of 1776	1292	regsvr32.exe	27
PID 1292 wrote to memory of 1776	1292	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b4dfee961b77fce87e1f534d34d657b1.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\QQzlewRIqYeRXC\qnNtSyrfVZnU.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1776

memory/1292-54-0x000007FEFC211000-0x000007FEFC213000-memory.dmp

Download

memory/1292-55-0x0000000180000000-0x000000018002E000-memory.dmp

Download