emotet | 070a8f0014d8abc29b4cd9a776b82c3bb167b6bd10d67ae3fa83400aebe210fe

Analysis

Target
070a8f0014d8abc29b4cd9a776b82c3bb167b6bd10d67ae3fa83400aebe210fe.dll
Size 252KB
Sample211116-nbehaaader
SHA256 070a8f0014d8abc29b4cd9a776b82c3bb167b6bd10d67ae3fa83400aebe210fe
MD5 ff909c61386b0b32c1ea0892e3a1f681
SHA1 cc851821a06f228d046b8dadc0468ebc0d27e746
SHA512 aad5e5050d2c662b7f85320c7efde0604c1113163e13c44bb04692429da68232b503d829645e8a7e7b7c4adfb1e90df546ba8d6a46b8799effe71e838e560524
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Blocklisted process makes network request 4 IoCs

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
320	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1412	1924	rundll32.exe	27
PID 1924 wrote to memory of 1412	1924	rundll32.exe	27
PID 1924 wrote to memory of 1412	1924	rundll32.exe	27
PID 1924 wrote to memory of 1412	1924	rundll32.exe	27
PID 1924 wrote to memory of 1412	1924	rundll32.exe	27
PID 1924 wrote to memory of 1412	1924	rundll32.exe	27
PID 1924 wrote to memory of 1412	1924	rundll32.exe	27
PID 1412 wrote to memory of 320	1412	rundll32.exe	28
PID 1412 wrote to memory of 320	1412	rundll32.exe	28
PID 1412 wrote to memory of 320	1412	rundll32.exe	28
PID 1412 wrote to memory of 320	1412	rundll32.exe	28
PID 1412 wrote to memory of 320	1412	rundll32.exe	28
PID 1412 wrote to memory of 320	1412	rundll32.exe	28
PID 1412 wrote to memory of 320	1412	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\070a8f0014d8abc29b4cd9a776b82c3bb167b6bd10d67ae3fa83400aebe210fe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\070a8f0014d8abc29b4cd9a776b82c3bb167b6bd10d67ae3fa83400aebe210fe.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\070a8f0014d8abc29b4cd9a776b82c3bb167b6bd10d67ae3fa83400aebe210fe.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:320

memory/1412-56-0x0000000076171000-0x0000000076173000-memory.dmp

Download

memory/1412-59-0x0000000010000000-0x0000000010028000-memory.dmp

Download