emotet | f840e8e35ed6d84d751b778e68b26a4e29b027473dc9cba4ba67d0a92582dbef

Analysis

Target
f840e8e35ed6d84d751b778e68b26a4e29b027473dc9cba4ba67d0a92582dbef.dll
Size 252KB
Sample211116-m9966sddd8
SHA256 f840e8e35ed6d84d751b778e68b26a4e29b027473dc9cba4ba67d0a92582dbef
MD5 157f44649db2f1542a5feb372450dd2c
SHA1 923ed81646acdba9c37677590eb8da0482f08e9a
SHA512 2d966076d3f5ee1eacacef767f3f32a67b1c1fde989e883a9f7852c6c034dfd145cabef4c1eaa52e788798ab61e70e3a93410f7a858130774356e36aded0ba88
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 3 IoCs

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3716	rundll32.exe
3716	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 3844	2772	rundll32.exe	68
PID 2772 wrote to memory of 3844	2772	rundll32.exe	68
PID 2772 wrote to memory of 3844	2772	rundll32.exe	68
PID 3844 wrote to memory of 3716	3844	rundll32.exe	69
PID 3844 wrote to memory of 3716	3844	rundll32.exe	69
PID 3844 wrote to memory of 3716	3844	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f840e8e35ed6d84d751b778e68b26a4e29b027473dc9cba4ba67d0a92582dbef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f840e8e35ed6d84d751b778e68b26a4e29b027473dc9cba4ba67d0a92582dbef.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\f840e8e35ed6d84d751b778e68b26a4e29b027473dc9cba4ba67d0a92582dbef.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3716

memory/3844-120-0x0000000010000000-0x0000000010028000-memory.dmp

Download