emotet | 291ba375ab40b772b6612d21165f09d949fdb7f5ee9d9ebf150db80ece1eff6c

Analysis

Target
5OWKFgtaLoINh8UFMms.dll
Size 649KB
Sample220607-lc29mahahk
SHA256 291ba375ab40b772b6612d21165f09d949fdb7f5ee9d9ebf150db80ece1eff6c
MD5 b4e3bef7f04ae62804cbe4f5b7f8e94b
SHA1 96cb58a2e07c9fc7e8c48fbbe54065f8438b1d3e
SHA512 3f6af52eb4f4314235628bff93631407a4b05ee872702ebb7c74751d804adb2300bed259ecc457c6678c1f85dfddec215ddc27032dc4c50b3196be63627aff37
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4264	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 4932	4264	regsvr32.exe	79
PID 4264 wrote to memory of 4932	4264	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5OWKFgtaLoINh8UFMms.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ORXxhVMTUCa\vOuaMFA.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4932

memory/4264-130-0x0000000002290000-0x0000000002339000-memory.dmp

Download

memory/4264-132-0x0000000180000000-0x000000018002A000-memory.dmp

Download