emotet | 8582757782e4048ba84898de0953c7c9710d84c2e764d1fca8b1d393c436dbc8

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2023, 12:19

Target
tPuBVdK7di.dll
Size 527.5MB
Sample230630-phpr9sbe6v
SHA256 a6e1b44ccb61a67b8e16ddc67eccacdd4b9b31a9de1fd048793c5c46b22337e2
MD5 d4d306a6d9d1ae637e0cfacf04f7431a
SHA1 68b7fb0aa0d65569aa62937620f58a50bd3e9fdd
SHA512 d473a2c746eba2b0add8252f5d44eca39b5a862978de80bc8e0d83f3adfee4601f21bcba3f63caa4fda02fc4c79cae704ac0905f4c938af8abbc2381332f682c
SSDEEP 6144:ZS+strpYZOLnN6zBiWmLcipbxTV5bEgWrhTmi3ve2vof2PPMIf39yeuLcLwdi:ZbapYTiDcidxTJUdpe2vofQMIfUb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{76496C7C-F7FA-4754-92BF-F80F06613B6D}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{70EF64E1-2AC5-431F-A2CA-B1B41F0A9BDC}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F1F59EEC-3D55-4FD6-8DB5-55C722338BF9}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{7394352C-33F8-4144-8AFC-859D6088A669}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F8AB7851-35AA-46E8-9128-5FF7E517ED75}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{7FCFE56F-272A-44D1-B9F2-04774F57EB3F}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{E0ADF60B-02B1-48EA-A9FB-CFB114E7719C}.catalogItem	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3692	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 1076	3692	regsvr32.exe	82
PID 3692 wrote to memory of 1076	3692	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\tPuBVdK7di.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\CuHsuGI\VJxfUdXSoWx.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1076

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:2856

memory/3692-133-0x0000000180000000-0x000000018002D000-memory.dmp

Download

memory/3692-136-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

Download