emotet | df2689deb8334e19292077d1a8ac61549f58a9dfbc930d047e18659ab87ab70f

Analysis

Target
df2689deb8334e19292077d1a8ac61549f58a9dfbc930d047e18659ab87ab70f.dll
Size 252KB
Sample211116-nb2mtadec3
SHA256 df2689deb8334e19292077d1a8ac61549f58a9dfbc930d047e18659ab87ab70f
MD5 b8b9d90dd3bf53836cc0ce850d3957e6
SHA1 a89feb414ad742b2ccdb423391953581942df6ad
SHA512 ccb21dd8b20275087cd2d880c5fab094527a0f3c3d7bc2d8da67f907caddfbaac5620726db85fdd3d37b67e3c27e008086e670da34fa2d99a8ab34dc00ebc3c5
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 12 IoCs

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
888	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1988	1936	rundll32.exe	27
PID 1936 wrote to memory of 1988	1936	rundll32.exe	27
PID 1936 wrote to memory of 1988	1936	rundll32.exe	27
PID 1936 wrote to memory of 1988	1936	rundll32.exe	27
PID 1936 wrote to memory of 1988	1936	rundll32.exe	27
PID 1936 wrote to memory of 1988	1936	rundll32.exe	27
PID 1936 wrote to memory of 1988	1936	rundll32.exe	27
PID 1988 wrote to memory of 888	1988	rundll32.exe	29
PID 1988 wrote to memory of 888	1988	rundll32.exe	29
PID 1988 wrote to memory of 888	1988	rundll32.exe	29
PID 1988 wrote to memory of 888	1988	rundll32.exe	29
PID 1988 wrote to memory of 888	1988	rundll32.exe	29
PID 1988 wrote to memory of 888	1988	rundll32.exe	29
PID 1988 wrote to memory of 888	1988	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\df2689deb8334e19292077d1a8ac61549f58a9dfbc930d047e18659ab87ab70f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\df2689deb8334e19292077d1a8ac61549f58a9dfbc930d047e18659ab87ab70f.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\df2689deb8334e19292077d1a8ac61549f58a9dfbc930d047e18659ab87ab70f.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:888

memory/1988-56-0x0000000075F41000-0x0000000075F43000-memory.dmp

Download

memory/1988-59-0x0000000010000000-0x0000000010028000-memory.dmp

Download