emotet | 0c5baba2c4765a181a75d6b2d766dd2e6dfb9167ea58c5cefd0c00eed154d602

Analysis

Target
0c5baba2c4765a181a75d6b2d766dd2e6dfb9167ea58c5cefd0c00eed154d602.dll
Size 252KB
Sample211116-s5cm1aedh9
SHA256 0c5baba2c4765a181a75d6b2d766dd2e6dfb9167ea58c5cefd0c00eed154d602
MD5 2d857677a82950bc3df35b1438c32184
SHA1 5e9a9180de5ee0c7679daa64665b1eead539637e
SHA512 2b35f06fac870df4242df698c868ebf2f49025da4ee625e54ee6560f16d5f3dc952cb127aeda4a325e3c41480de4ad55f14828003e525493fd6b4bb5ee320fa0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 3 IoCs

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3956	rundll32.exe
3956	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 3992	4004	rundll32.exe	69
PID 4004 wrote to memory of 3992	4004	rundll32.exe	69
PID 4004 wrote to memory of 3992	4004	rundll32.exe	69
PID 3992 wrote to memory of 3956	3992	rundll32.exe	70
PID 3992 wrote to memory of 3956	3992	rundll32.exe	70
PID 3992 wrote to memory of 3956	3992	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c5baba2c4765a181a75d6b2d766dd2e6dfb9167ea58c5cefd0c00eed154d602.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c5baba2c4765a181a75d6b2d766dd2e6dfb9167ea58c5cefd0c00eed154d602.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\0c5baba2c4765a181a75d6b2d766dd2e6dfb9167ea58c5cefd0c00eed154d602.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3956

memory/3992-120-0x0000000010000000-0x0000000010028000-memory.dmp

Download