emotet | ec0e781be8228d0902e529727f4fdf82d2945e9d948fad0ea5efb67e4149bca2

Analysis

max time kernel
118s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
08/02/2023, 09:55

Target
62b4e33474fa6ef9e22b8f22b1918315e6ecb6d18066d3b1e7a29181d29323f6.dll
Size 514KB
Sample230208-lxyryaaa82
SHA256 62b4e33474fa6ef9e22b8f22b1918315e6ecb6d18066d3b1e7a29181d29323f6
MD5 5397887cac09d8d9f50871894ada5dfb
SHA1 67a4b778ddc036e85d64585965f2cb2fb9bc699d
SHA512 55a5655e5d7ed6f84ad024eb1b58c0ffc31e957c16782acd49b3cc1a3b0515ff7e742c1247fd2dae9ebe11989f21bdc4c08a8dd9b7c2b4db51bfafb194a675f7
SSDEEP 6144:LVvauc175GwSlLaD0adqHQFHQFHQFHQFHQZcH+J8aLi/ZnZLtO/ydWp3kklPSiNO:LViuc175Gw/DtcUKmvJSYCQqTI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 4884	4904	regsvr32.exe	83
PID 4904 wrote to memory of 4884	4904	regsvr32.exe	83
PID 4904 wrote to memory of 4884	4904	regsvr32.exe	83
PID 4884 wrote to memory of 2672	4884	regsvr32.exe	84
PID 4884 wrote to memory of 2672	4884	regsvr32.exe	84
PID 4884 wrote to memory of 2672	4884	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\62b4e33474fa6ef9e22b8f22b1918315e6ecb6d18066d3b1e7a29181d29323f6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\62b4e33474fa6ef9e22b8f22b1918315e6ecb6d18066d3b1e7a29181d29323f6.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\62b4e33474fa6ef9e22b8f22b1918315e6ecb6d18066d3b1e7a29181d29323f6.dll",DllRegisterServer
    3⤵
    PID:2672

memory/4884-133-0x0000000010000000-0x0000000010025000-memory.dmp

Download