emotet | 4feca14a63d3f9246d828699f4d0315fd4af4c1ae93f1e1e93a2a9ee632a336b

Analysis

Target
4feca14a63d3f9246d828699f4d0315fd4af4c1ae93f1e1e93a2a9ee632a336b.dll
Size 252KB
Sample211116-nbehaadea4
SHA256 4feca14a63d3f9246d828699f4d0315fd4af4c1ae93f1e1e93a2a9ee632a336b
MD5 a76d322a78613cb5543d17e315203a8b
SHA1 92512e15437a715b5ff6f9917de212ea3b8203eb
SHA512 41b26cd65dfc259daeaf00f77b5dada0066b8a6ea64f7dc53d3ec70bc3e85b85faf3570981d47a467840a60b2d5efe1786d567f77f8cd0fa21b62090b5ac6016
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 3 IoCs

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2200	rundll32.exe
2200	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 4324	2196	rundll32.exe	68
PID 2196 wrote to memory of 4324	2196	rundll32.exe	68
PID 2196 wrote to memory of 4324	2196	rundll32.exe	68
PID 4324 wrote to memory of 2200	4324	rundll32.exe	69
PID 4324 wrote to memory of 2200	4324	rundll32.exe	69
PID 4324 wrote to memory of 2200	4324	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4feca14a63d3f9246d828699f4d0315fd4af4c1ae93f1e1e93a2a9ee632a336b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4feca14a63d3f9246d828699f4d0315fd4af4c1ae93f1e1e93a2a9ee632a336b.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\4feca14a63d3f9246d828699f4d0315fd4af4c1ae93f1e1e93a2a9ee632a336b.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:2200

memory/4324-117-0x0000000010000000-0x0000000010028000-memory.dmp

Download