emotet | 212fff7721e43dff7db6bd7a5df41d57dac21bbf9a9c7c952e5a4a11092761b7

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18/01/2023, 00:54

Target
2a4865151e02af3be15b37f8ac07dec5.dll
Size 882KB
Sample230118-a879zagg21
SHA256 212fff7721e43dff7db6bd7a5df41d57dac21bbf9a9c7c952e5a4a11092761b7
MD5 2a4865151e02af3be15b37f8ac07dec5
SHA1 5bf4548d6fcbf74c0b630c3a0daafa25804cb1cb
SHA512 dc547201c22e5a88f972d97f09555a571b2595b9d90aab545b5fd7c6a209c9190c8e97f834c39ee31ded41f08bf04fc8f8ecd28b8f27f911eafdc3a6d049ba84
SSDEEP 12288:OY67TI+4RcCD01BkNsNi0MBpIwz0WMWQdshDQ1xA3:Opk+4Rj01BkN3tphz0WMTmYK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
748	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 1780	748	regsvr32.exe	28
PID 748 wrote to memory of 1780	748	regsvr32.exe	28
PID 748 wrote to memory of 1780	748	regsvr32.exe	28
PID 748 wrote to memory of 1780	748	regsvr32.exe	28
PID 748 wrote to memory of 1780	748	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2a4865151e02af3be15b37f8ac07dec5.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MAVPy\JwGxEVpIeUNh.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1780

memory/748-54-0x000007FEFBC61000-0x000007FEFBC63000-memory.dmp

Download

memory/748-55-0x0000000001E00000-0x0000000001E2F000-memory.dmp

Download