emotet | dc4ecc67b36afe5bb29bd472efcd0bb6e52b25bf3d6f5a11649ad16f71474727

Analysis

Target
gvWvBni9HcU6I.dll
Size 252KB
Sample211117-r1ageadaa2
SHA256 dc4ecc67b36afe5bb29bd472efcd0bb6e52b25bf3d6f5a11649ad16f71474727
MD5 f5636291fe336c58c7b495d522db6d0e
SHA1 b8eb9565e63b71ca97ec98db49833f2ce9ec6de7
SHA512 b28cf9eb9e38a15c5857e0b7ec4220fc26d5919281511c82983f69c5aea75bddb35e6aaf63a6dbef3421c871b18a8aad80c43932436aa7cfdd172780fc1603eb
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 2 IoCs

flow	pid	Process
16	1900	rundll32.exe
17	1900	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1900	rundll32.exe
1900	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 3548	3560	rundll32.exe	68
PID 3560 wrote to memory of 3548	3560	rundll32.exe	68
PID 3560 wrote to memory of 3548	3560	rundll32.exe	68
PID 3548 wrote to memory of 1900	3548	rundll32.exe	69
PID 3548 wrote to memory of 1900	3548	rundll32.exe	69
PID 3548 wrote to memory of 1900	3548	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gvWvBni9HcU6I.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gvWvBni9HcU6I.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\gvWvBni9HcU6I.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:1900

memory/3548-120-0x0000000010000000-0x0000000010028000-memory.dmp

Download