7021a3dae8d35b1036e93a8fd17199b32fe3974724c585ed9d411661159d8507 | Triage

Analysis

max time kernel
139s
max time network
145s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23-03-2023 17:57

Sharing

Report Analysis Logs

General

Target

emotet.dll
Size

348KB
MD5

c6415d70b8d540c78766a3e4b671b97c
SHA1

fe305bc8aeac9a79ca5ece68c9a89a418a331072
SHA256

7021a3dae8d35b1036e93a8fd17199b32fe3974724c585ed9d411661159d8507
SHA512

6f18a3ac33c3932198fd807a0655fa5b113f5310e8552ff1615a24517145e9440d56da10177e3f84b5f6966c6980aa44cd1895379cb755c4748eb6d5d37ac72e
SSDEEP

6144:BX1K0hROWQHfYtH4ve6REwSBPuuOVN7Oc5jthTq5wzDigKa:F1KMEWQHfaYveI6OT7x/1Digb

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

928 regsvr32.exe
1944 regsvr32.exe
1944 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

928 regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 928 wrote to memory of 1944	928	regsvr32.exe	regsvr32.exe
PID 928 wrote to memory of 1944	928	regsvr32.exe	regsvr32.exe
PID 928 wrote to memory of 1944	928	regsvr32.exe	regsvr32.exe
PID 928 wrote to memory of 1944	928	regsvr32.exe	regsvr32.exe
PID 928 wrote to memory of 1944	928	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:928

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GEhCdsVjBODP\VTSkLf.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...