emotet | d5f4292d4f5661ce12dd8384cfbb22a3d17908290ba80d9de3a1697064d248a7

Analysis

Target
d5f4292d4f5661ce12dd8384cfbb22a3d17908290ba80d9de3a1697064d248a7.dll
Size 252KB
Sample211116-navg4saddn
SHA256 d5f4292d4f5661ce12dd8384cfbb22a3d17908290ba80d9de3a1697064d248a7
MD5 e96b3311683da0a230221af526d24930
SHA1 d69fadb29c7168a1763bf7e654c32d6cca0c7403
SHA512 5b8405a1775e005b1c8545d5df3207c067cef670225b6d334a36302f2d198ab8b8de4fca5d4ad960a4340d004b4798b6d2b90f0d4845a0c4293476303f6862fb
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Blocklisted process makes network request 3 IoCs

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4072	rundll32.exe
4072	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2780	2728	rundll32.exe	68
PID 2728 wrote to memory of 2780	2728	rundll32.exe	68
PID 2728 wrote to memory of 2780	2728	rundll32.exe	68
PID 2780 wrote to memory of 4072	2780	rundll32.exe	69
PID 2780 wrote to memory of 4072	2780	rundll32.exe	69
PID 2780 wrote to memory of 4072	2780	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d5f4292d4f5661ce12dd8384cfbb22a3d17908290ba80d9de3a1697064d248a7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d5f4292d4f5661ce12dd8384cfbb22a3d17908290ba80d9de3a1697064d248a7.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\d5f4292d4f5661ce12dd8384cfbb22a3d17908290ba80d9de3a1697064d248a7.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:4072

memory/2780-116-0x0000000010000000-0x0000000010028000-memory.dmp

Download