emotet | b41cadbef93cb7c90503700b8a8292eae04e61b87aa01f96b5858528d362c945

Analysis

Target
8c5d68d8080fff28bdc7785e22e8155f.dll
Size 259KB
Sample211118-acnwfsbdbl
SHA256 b41cadbef93cb7c90503700b8a8292eae04e61b87aa01f96b5858528d362c945
MD5 8c5d68d8080fff28bdc7785e22e8155f
SHA1 c25f4bcfcc8ee79eb7b5b7475fcee095c3ff1872
SHA512 72ce280cf4c992074a10243bc0a11d5d32eb5faa3e0f0612b23ff9c9eb39ec08b105389715015caed156c8f203028ff8df57e138d4442d25a61eceaf8f9b20a0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	1516	rundll32.exe
6	1516	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1516	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 776	724	rundll32.exe	28
PID 724 wrote to memory of 776	724	rundll32.exe	28
PID 724 wrote to memory of 776	724	rundll32.exe	28
PID 724 wrote to memory of 776	724	rundll32.exe	28
PID 724 wrote to memory of 776	724	rundll32.exe	28
PID 724 wrote to memory of 776	724	rundll32.exe	28
PID 724 wrote to memory of 776	724	rundll32.exe	28
PID 776 wrote to memory of 1516	776	rundll32.exe	29
PID 776 wrote to memory of 1516	776	rundll32.exe	29
PID 776 wrote to memory of 1516	776	rundll32.exe	29
PID 776 wrote to memory of 1516	776	rundll32.exe	29
PID 776 wrote to memory of 1516	776	rundll32.exe	29
PID 776 wrote to memory of 1516	776	rundll32.exe	29
PID 776 wrote to memory of 1516	776	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c5d68d8080fff28bdc7785e22e8155f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c5d68d8080fff28bdc7785e22e8155f.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:776
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\8c5d68d8080fff28bdc7785e22e8155f.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:1516

memory/776-56-0x0000000074E51000-0x0000000074E53000-memory.dmp

Download

memory/776-59-0x0000000010000000-0x0000000010028000-memory.dmp

Download