emotet | 4d424f1915c5c30f96bb6c0bc334c5f6d8a17d53cd596155579f9323b6fb7c5d

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13/11/2022, 15:59

Target
118b1ec3900ac9500fda27379dabf44b.dll
Size 516KB
Sample221113-te21msbf39
SHA256 4d424f1915c5c30f96bb6c0bc334c5f6d8a17d53cd596155579f9323b6fb7c5d
MD5 118b1ec3900ac9500fda27379dabf44b
SHA1 983a0c3a5b5ad5144f2a963d044ec719ea894412
SHA512 9d6f74417917c487aacacd83ad0e762753c844a03018ca05ca3dff6c8ab4846232292c4ab8b56fef6eb8206429dbdf47ce29971fe650f80e4afa73029fd046dd
SSDEEP 6144:mW1239bnTe+0Qv7NSEBj43USaI6Y/jOpxHRikSYI+QALgIJ1divndEXvn:mW1e9PeexPBjvKSpuvYI+TLgs1dcEXv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1980	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 980	1980	regsvr32.exe	28
PID 1980 wrote to memory of 980	1980	regsvr32.exe	28
PID 1980 wrote to memory of 980	1980	regsvr32.exe	28
PID 1980 wrote to memory of 980	1980	regsvr32.exe	28
PID 1980 wrote to memory of 980	1980	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\118b1ec3900ac9500fda27379dabf44b.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\BlpNtJVL\UjfHIXdELFQPB.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:980

memory/1980-54-0x000007FEFB7B1000-0x000007FEFB7B3000-memory.dmp

Download

memory/1980-55-0x0000000180000000-0x000000018002E000-memory.dmp

Download