emotet | df2689deb8334e19292077d1a8ac61549f58a9dfbc930d047e18659ab87ab70f

Analysis

Target
df2689deb8334e19292077d1a8ac61549f58a9dfbc930d047e18659ab87ab70f.dll
Size 252KB
Sample211116-nb2mtadec3
SHA256 df2689deb8334e19292077d1a8ac61549f58a9dfbc930d047e18659ab87ab70f
MD5 b8b9d90dd3bf53836cc0ce850d3957e6
SHA1 a89feb414ad742b2ccdb423391953581942df6ad
SHA512 ccb21dd8b20275087cd2d880c5fab094527a0f3c3d7bc2d8da67f907caddfbaac5620726db85fdd3d37b67e3c27e008086e670da34fa2d99a8ab34dc00ebc3c5
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 3 IoCs

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3740	rundll32.exe
3740	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2784	2740	rundll32.exe	68
PID 2740 wrote to memory of 2784	2740	rundll32.exe	68
PID 2740 wrote to memory of 2784	2740	rundll32.exe	68
PID 2784 wrote to memory of 3740	2784	rundll32.exe	69
PID 2784 wrote to memory of 3740	2784	rundll32.exe	69
PID 2784 wrote to memory of 3740	2784	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\df2689deb8334e19292077d1a8ac61549f58a9dfbc930d047e18659ab87ab70f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\df2689deb8334e19292077d1a8ac61549f58a9dfbc930d047e18659ab87ab70f.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\df2689deb8334e19292077d1a8ac61549f58a9dfbc930d047e18659ab87ab70f.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3740

memory/2784-120-0x0000000010000000-0x0000000010028000-memory.dmp

Download