emotet | 4feca14a63d3f9246d828699f4d0315fd4af4c1ae93f1e1e93a2a9ee632a336b

Analysis

Target
4feca14a63d3f9246d828699f4d0315fd4af4c1ae93f1e1e93a2a9ee632a336b.dll
Size 252KB
Sample211116-nbehaadea4
SHA256 4feca14a63d3f9246d828699f4d0315fd4af4c1ae93f1e1e93a2a9ee632a336b
MD5 a76d322a78613cb5543d17e315203a8b
SHA1 92512e15437a715b5ff6f9917de212ea3b8203eb
SHA512 41b26cd65dfc259daeaf00f77b5dada0066b8a6ea64f7dc53d3ec70bc3e85b85faf3570981d47a467840a60b2d5efe1786d567f77f8cd0fa21b62090b5ac6016
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 4 IoCs

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
524	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 268	652	rundll32.exe	28
PID 652 wrote to memory of 268	652	rundll32.exe	28
PID 652 wrote to memory of 268	652	rundll32.exe	28
PID 652 wrote to memory of 268	652	rundll32.exe	28
PID 652 wrote to memory of 268	652	rundll32.exe	28
PID 652 wrote to memory of 268	652	rundll32.exe	28
PID 652 wrote to memory of 268	652	rundll32.exe	28
PID 268 wrote to memory of 524	268	rundll32.exe	29
PID 268 wrote to memory of 524	268	rundll32.exe	29
PID 268 wrote to memory of 524	268	rundll32.exe	29
PID 268 wrote to memory of 524	268	rundll32.exe	29
PID 268 wrote to memory of 524	268	rundll32.exe	29
PID 268 wrote to memory of 524	268	rundll32.exe	29
PID 268 wrote to memory of 524	268	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4feca14a63d3f9246d828699f4d0315fd4af4c1ae93f1e1e93a2a9ee632a336b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4feca14a63d3f9246d828699f4d0315fd4af4c1ae93f1e1e93a2a9ee632a336b.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\4feca14a63d3f9246d828699f4d0315fd4af4c1ae93f1e1e93a2a9ee632a336b.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:524

memory/268-56-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/268-59-0x0000000010000000-0x0000000010028000-memory.dmp

Download