emotet | 759c9bd7d8b247a07821d8410067d350ba7a4ec2c02f01799da8cdcb4d7237be

Analysis

Target
759c9bd7d8b247a07821d8410067d350ba7a4ec2c02f01799da8cdcb4d7237be.dll
Size 252KB
Sample211116-navg4saddl
SHA256 759c9bd7d8b247a07821d8410067d350ba7a4ec2c02f01799da8cdcb4d7237be
MD5 b204ee1935df4b8412f447a87dc1c1d4
SHA1 3294f2c5fe0441df9ed889c5d806228d176462ab
SHA512 6498d1bb7b51c84e5a931c4148508849b767abe2ed50119f11b48b8a66e2f6a82838473dc1ba36ce5d8eb9f883670301d2f9aa0b9a22e75f6f4976d5a79ee22a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Blocklisted process makes network request 3 IoCs

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3916	rundll32.exe
3916	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 3760	3496	rundll32.exe	68
PID 3496 wrote to memory of 3760	3496	rundll32.exe	68
PID 3496 wrote to memory of 3760	3496	rundll32.exe	68
PID 3760 wrote to memory of 3916	3760	rundll32.exe	69
PID 3760 wrote to memory of 3916	3760	rundll32.exe	69
PID 3760 wrote to memory of 3916	3760	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\759c9bd7d8b247a07821d8410067d350ba7a4ec2c02f01799da8cdcb4d7237be.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\759c9bd7d8b247a07821d8410067d350ba7a4ec2c02f01799da8cdcb4d7237be.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\759c9bd7d8b247a07821d8410067d350ba7a4ec2c02f01799da8cdcb4d7237be.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3916

memory/3760-120-0x0000000010000000-0x0000000010028000-memory.dmp

Download