emotet | 0232e167cf625173250eccd2c7b40ba031d4e0cbbe8cecc84376ee3fd05a2246

Analysis

Target
0232e167cf625173250eccd2c7b40ba031d4e0cbbe8cecc84376ee3fd05a2246.dll
Size 252KB
Sample211116-navg4sadcq
SHA256 0232e167cf625173250eccd2c7b40ba031d4e0cbbe8cecc84376ee3fd05a2246
MD5 12ade7ea9c0be040c0fed6baff501b13
SHA1 e69e2ae59e91e80340175d6c93c410f79f0cf26f
SHA512 89d536a3957657982364b77159e470ee8e9009de12a8e1e9e70720959eceb49867fa6e0d78c997303b53cb043b265fc8aeca9c4326ed801c1d8a5d04d123bbc9
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Blocklisted process makes network request 3 IoCs

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2236	rundll32.exe
2236	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 3524	3536	rundll32.exe	68
PID 3536 wrote to memory of 3524	3536	rundll32.exe	68
PID 3536 wrote to memory of 3524	3536	rundll32.exe	68
PID 3524 wrote to memory of 2236	3524	rundll32.exe	69
PID 3524 wrote to memory of 2236	3524	rundll32.exe	69
PID 3524 wrote to memory of 2236	3524	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0232e167cf625173250eccd2c7b40ba031d4e0cbbe8cecc84376ee3fd05a2246.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0232e167cf625173250eccd2c7b40ba031d4e0cbbe8cecc84376ee3fd05a2246.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\0232e167cf625173250eccd2c7b40ba031d4e0cbbe8cecc84376ee3fd05a2246.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:2236

memory/3524-120-0x0000000010000000-0x0000000010028000-memory.dmp

Download