emotet | 4d0559104e41847ddcc2039d7cc0bd81d4b997706c8dffdbbe1a8b7aa213243a

Analysis

Target
4d0559104e41847ddcc2039d7cc0bd81d4b997706c8dffdbbe1a8b7aa213243a.dll
Size 252KB
Sample211116-m9966sdde3
SHA256 4d0559104e41847ddcc2039d7cc0bd81d4b997706c8dffdbbe1a8b7aa213243a
MD5 834fe5ba802bbbdd607b146d47e213d9
SHA1 6d789cfb514fd76f3d9e7eb69ad774badc0a629c
SHA512 3d5fc12664f67600c351624cc222fffbe64ee3aa540a56ce4db8b9387facf7d7c3df813c990e896fa1d112762e143cfa62d804b3170a2b77071b0ce56b53edc9
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 2 IoCs

flow	pid	Process
16	2676	rundll32.exe
17	2676	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2676	rundll32.exe
2676	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2608	2576	rundll32.exe	68
PID 2576 wrote to memory of 2608	2576	rundll32.exe	68
PID 2576 wrote to memory of 2608	2576	rundll32.exe	68
PID 2608 wrote to memory of 2676	2608	rundll32.exe	69
PID 2608 wrote to memory of 2676	2608	rundll32.exe	69
PID 2608 wrote to memory of 2676	2608	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d0559104e41847ddcc2039d7cc0bd81d4b997706c8dffdbbe1a8b7aa213243a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d0559104e41847ddcc2039d7cc0bd81d4b997706c8dffdbbe1a8b7aa213243a.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\4d0559104e41847ddcc2039d7cc0bd81d4b997706c8dffdbbe1a8b7aa213243a.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:2676

memory/2608-120-0x0000000010000000-0x0000000010028000-memory.dmp

Download