emotet | bcba95c90fb7d8c6e28fc229b4bbf4b1ad153cf114c2ca1093a02285e5a5f88d

Analysis

Target
bcba95c90fb7d8c6e28fc229b4bbf4b1ad153cf114c2ca1093a02285e5a5f88d.dll
Size 252KB
Sample211116-nb2mtaadgr
SHA256 bcba95c90fb7d8c6e28fc229b4bbf4b1ad153cf114c2ca1093a02285e5a5f88d
MD5 4136d3148555282b0034493001777bf9
SHA1 5c642923743bcfcf4703610a86a882eb62c1c5a0
SHA512 590f51f62eccfca8a6a2677392d0b180f13b7f1fadeea092ca45177255edea0a311095e48c10aeea03bcd879f9f444cbf83f9e22e947c1f9ba15b214a0cd5a97
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 13 IoCs

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
532	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1788	1652	rundll32.exe	27
PID 1652 wrote to memory of 1788	1652	rundll32.exe	27
PID 1652 wrote to memory of 1788	1652	rundll32.exe	27
PID 1652 wrote to memory of 1788	1652	rundll32.exe	27
PID 1652 wrote to memory of 1788	1652	rundll32.exe	27
PID 1652 wrote to memory of 1788	1652	rundll32.exe	27
PID 1652 wrote to memory of 1788	1652	rundll32.exe	27
PID 1788 wrote to memory of 532	1788	rundll32.exe	29
PID 1788 wrote to memory of 532	1788	rundll32.exe	29
PID 1788 wrote to memory of 532	1788	rundll32.exe	29
PID 1788 wrote to memory of 532	1788	rundll32.exe	29
PID 1788 wrote to memory of 532	1788	rundll32.exe	29
PID 1788 wrote to memory of 532	1788	rundll32.exe	29
PID 1788 wrote to memory of 532	1788	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcba95c90fb7d8c6e28fc229b4bbf4b1ad153cf114c2ca1093a02285e5a5f88d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcba95c90fb7d8c6e28fc229b4bbf4b1ad153cf114c2ca1093a02285e5a5f88d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\bcba95c90fb7d8c6e28fc229b4bbf4b1ad153cf114c2ca1093a02285e5a5f88d.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:532

memory/1788-56-0x0000000076431000-0x0000000076433000-memory.dmp

Download

memory/1788-59-0x0000000010000000-0x0000000010028000-memory.dmp

Download