64e86483c5fa5ac252a6bf087b44085a4d536b184e0ee95d79617ad1e4505e49 | Triage

Analysis

max time kernel
145s
max time network
150s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31-03-2023 12:41

Sharing

Report Analysis Logs

General

Target

emotet_unpack.dll
Size

360KB
MD5

07e1fcd7c2bd9805e2c33e83393b7298
SHA1

8a43110b792151ae857122f8425666fc8ac55aaf
SHA256

64e86483c5fa5ac252a6bf087b44085a4d536b184e0ee95d79617ad1e4505e49
SHA512

5fa9843215c04b4339a7dfa94ab6fa583b4535de231e09e915c36ceebca8627610dd6a7d8e13c72030618f6779301d43436d18bdc47fc6696d34ffc47a2e8dab
SSDEEP

6144:BX1K0hROWQHfYtH4ve6REwSBPuuOVN7Oc5jthTq5wzDigKa:F1KMEWQHfaYveI6OT7x/1Digb

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1676 regsvr32.exe
1628 regsvr32.exe
1628 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

1676 regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1676 wrote to memory of 1628	1676	regsvr32.exe	regsvr32.exe
PID 1676 wrote to memory of 1628	1676	regsvr32.exe	regsvr32.exe
PID 1676 wrote to memory of 1628	1676	regsvr32.exe	regsvr32.exe
PID 1676 wrote to memory of 1628	1676	regsvr32.exe	regsvr32.exe
PID 1676 wrote to memory of 1628	1676	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_unpack.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZQTlrxnvDjK\XCTloyT.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads