emotet | ff2a96c22656ab3b8320275f4ad7cb92e0183e12cf38efdd2d7f89504eb2292c

Analysis

Target
ff2a96c22656ab3b8320275f4ad7cb92e0183e12cf38efdd2d7f89504eb2292c.dll
Size 252KB
Sample211116-s3715aede5
SHA256 ff2a96c22656ab3b8320275f4ad7cb92e0183e12cf38efdd2d7f89504eb2292c
MD5 33dcb1515f9bd3214ef416a277efeba1
SHA1 6a9e2e846b674146befe34f801a1918f508faa74
SHA512 ac96579df710dd0fd81ce2812ad8d980dabfa1b99414e3c4beb69a9168a487c176f2ad129df614044dcaf7c7225c3d4cbe39322cecc4eb117851b6cf0f93c980
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 4 IoCs

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
700	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 676 wrote to memory of 472	676	rundll32.exe	28
PID 676 wrote to memory of 472	676	rundll32.exe	28
PID 676 wrote to memory of 472	676	rundll32.exe	28
PID 676 wrote to memory of 472	676	rundll32.exe	28
PID 676 wrote to memory of 472	676	rundll32.exe	28
PID 676 wrote to memory of 472	676	rundll32.exe	28
PID 676 wrote to memory of 472	676	rundll32.exe	28
PID 472 wrote to memory of 700	472	rundll32.exe	29
PID 472 wrote to memory of 700	472	rundll32.exe	29
PID 472 wrote to memory of 700	472	rundll32.exe	29
PID 472 wrote to memory of 700	472	rundll32.exe	29
PID 472 wrote to memory of 700	472	rundll32.exe	29
PID 472 wrote to memory of 700	472	rundll32.exe	29
PID 472 wrote to memory of 700	472	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff2a96c22656ab3b8320275f4ad7cb92e0183e12cf38efdd2d7f89504eb2292c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff2a96c22656ab3b8320275f4ad7cb92e0183e12cf38efdd2d7f89504eb2292c.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:472
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ff2a96c22656ab3b8320275f4ad7cb92e0183e12cf38efdd2d7f89504eb2292c.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:700

memory/472-56-0x0000000075321000-0x0000000075323000-memory.dmp

Download

memory/472-59-0x0000000010000000-0x0000000010028000-memory.dmp

Download