emotet | bcba95c90fb7d8c6e28fc229b4bbf4b1ad153cf114c2ca1093a02285e5a5f88d

Analysis

Target
bcba95c90fb7d8c6e28fc229b4bbf4b1ad153cf114c2ca1093a02285e5a5f88d.dll
Size 252KB
Sample211116-nb2mtaadgr
SHA256 bcba95c90fb7d8c6e28fc229b4bbf4b1ad153cf114c2ca1093a02285e5a5f88d
MD5 4136d3148555282b0034493001777bf9
SHA1 5c642923743bcfcf4703610a86a882eb62c1c5a0
SHA512 590f51f62eccfca8a6a2677392d0b180f13b7f1fadeea092ca45177255edea0a311095e48c10aeea03bcd879f9f444cbf83f9e22e947c1f9ba15b214a0cd5a97
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Blocklisted process makes network request 8 IoCs

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2272	rundll32.exe
2272	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 652	3452	rundll32.exe	68
PID 3452 wrote to memory of 652	3452	rundll32.exe	68
PID 3452 wrote to memory of 652	3452	rundll32.exe	68
PID 652 wrote to memory of 2272	652	rundll32.exe	69
PID 652 wrote to memory of 2272	652	rundll32.exe	69
PID 652 wrote to memory of 2272	652	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcba95c90fb7d8c6e28fc229b4bbf4b1ad153cf114c2ca1093a02285e5a5f88d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcba95c90fb7d8c6e28fc229b4bbf4b1ad153cf114c2ca1093a02285e5a5f88d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:652
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\bcba95c90fb7d8c6e28fc229b4bbf4b1ad153cf114c2ca1093a02285e5a5f88d.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:2272

memory/652-117-0x0000000010000000-0x0000000010028000-memory.dmp

Download