emotet | 09ff9c88071f2fbd22b991bc70598ccae0ee3d6dfed2b1592f336b584eba236d

Analysis

Target
09ff9c88071f2fbd22b991bc70598ccae0ee3d6dfed2b1592f336b584eba236d.dll
Size 252KB
Sample211116-nbd7hsadek
SHA256 09ff9c88071f2fbd22b991bc70598ccae0ee3d6dfed2b1592f336b584eba236d
MD5 03d12a654adaa23ebc1e78e6d518fbf8
SHA1 fab8df29cd797d2c1d38dc8e815595714a6bb53c
SHA512 7fecf316e07ccbc7ac390cb224281f7df89cf8b56a703e1b0930a2a063f1482c745dd7bad4459ad783cb7cf7401a4b18d6f18d4c6aa543cf4cb0da9d77cd4a47
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Blocklisted process makes network request 4 IoCs

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1524	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 1216	1496	rundll32.exe	27
PID 1496 wrote to memory of 1216	1496	rundll32.exe	27
PID 1496 wrote to memory of 1216	1496	rundll32.exe	27
PID 1496 wrote to memory of 1216	1496	rundll32.exe	27
PID 1496 wrote to memory of 1216	1496	rundll32.exe	27
PID 1496 wrote to memory of 1216	1496	rundll32.exe	27
PID 1496 wrote to memory of 1216	1496	rundll32.exe	27
PID 1216 wrote to memory of 1524	1216	rundll32.exe	29
PID 1216 wrote to memory of 1524	1216	rundll32.exe	29
PID 1216 wrote to memory of 1524	1216	rundll32.exe	29
PID 1216 wrote to memory of 1524	1216	rundll32.exe	29
PID 1216 wrote to memory of 1524	1216	rundll32.exe	29
PID 1216 wrote to memory of 1524	1216	rundll32.exe	29
PID 1216 wrote to memory of 1524	1216	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09ff9c88071f2fbd22b991bc70598ccae0ee3d6dfed2b1592f336b584eba236d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09ff9c88071f2fbd22b991bc70598ccae0ee3d6dfed2b1592f336b584eba236d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\09ff9c88071f2fbd22b991bc70598ccae0ee3d6dfed2b1592f336b584eba236d.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:1524

memory/1216-56-0x0000000074E51000-0x0000000074E53000-memory.dmp

Download

memory/1216-59-0x0000000010000000-0x0000000010028000-memory.dmp

Download