emotet | 01d6ff441bfbf065fe9cc4a6ab5de658cfacfb46467eee4cf55441cbadf6e28c

Analysis

max time kernel
153s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2023, 18:47

Target
f232e278f50de52e6202c18f1d9711e7.dll
Size 831KB
Sample230119-xe665sdh21
SHA256 01d6ff441bfbf065fe9cc4a6ab5de658cfacfb46467eee4cf55441cbadf6e28c
MD5 f232e278f50de52e6202c18f1d9711e7
SHA1 fbc0221979aad4631d301bcd8e331c4399fdfde8
SHA512 75c37532bd8906eef1858dc77a7dd641da763c86d577de8b4223bcb2428d838ffe86d55312488c554a1f292453c1feccd3eaecfd38d22eab52a875a6eb0235be
SSDEEP 24576:F16TffbuFta+9ZeTKu7imuEnESFZqnUZ:+ffSFtBYTKuD8U
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

ecs1.plain

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4832	regsvr32.exe
4832	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4976	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 4832	4976	regsvr32.exe	82
PID 4976 wrote to memory of 4832	4976	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f232e278f50de52e6202c18f1d9711e7.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JhrflMHGxemn\bxPTHwa.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832

memory/4976-132-0x0000000180000000-0x0000000180031000-memory.dmp

Download