emotet | da215f442e73a432127f50b2b5ffdc7d45e009c5ef6c5fe3e0929faa7eacd3b0

Analysis

Target
da215f442e73a432127f50b2b5ffdc7d45e009c5ef6c5fe3e0929faa7eacd3b0.dll
Size 252KB
Sample211116-s5cb8sedh6
SHA256 da215f442e73a432127f50b2b5ffdc7d45e009c5ef6c5fe3e0929faa7eacd3b0
MD5 2037598a13b577d6d4d48f55fb294e6e
SHA1 208b659ae9c4db70c88149cdcb2ef456faff4ea5
SHA512 6832a1154d163718b2f70087f41c433acb846adc5e354e1ee5f5ac57ec91f64162b67b9db5c0f63fb7f49004752f4333c37b8b46cbdeaa4d5f9ebc537fcd0e1f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 3 IoCs

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3204	rundll32.exe
3204	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 4344	4340	rundll32.exe	68
PID 4340 wrote to memory of 4344	4340	rundll32.exe	68
PID 4340 wrote to memory of 4344	4340	rundll32.exe	68
PID 4344 wrote to memory of 3204	4344	rundll32.exe	69
PID 4344 wrote to memory of 3204	4344	rundll32.exe	69
PID 4344 wrote to memory of 3204	4344	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\da215f442e73a432127f50b2b5ffdc7d45e009c5ef6c5fe3e0929faa7eacd3b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\da215f442e73a432127f50b2b5ffdc7d45e009c5ef6c5fe3e0929faa7eacd3b0.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\da215f442e73a432127f50b2b5ffdc7d45e009c5ef6c5fe3e0929faa7eacd3b0.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3204

memory/4344-117-0x0000000010000000-0x0000000010028000-memory.dmp

Download