emotet | b41cadbef93cb7c90503700b8a8292eae04e61b87aa01f96b5858528d362c945

Analysis

Target
8c5d68d8080fff28bdc7785e22e8155f.dll
Size 259KB
Sample211118-acnwfsbdbl
SHA256 b41cadbef93cb7c90503700b8a8292eae04e61b87aa01f96b5858528d362c945
MD5 8c5d68d8080fff28bdc7785e22e8155f
SHA1 c25f4bcfcc8ee79eb7b5b7475fcee095c3ff1872
SHA512 72ce280cf4c992074a10243bc0a11d5d32eb5faa3e0f0612b23ff9c9eb39ec08b105389715015caed156c8f203028ff8df57e138d4442d25a61eceaf8f9b20a0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	2688	rundll32.exe
10	2688	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2688	rundll32.exe
2688	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2648	2456	rundll32.exe	68
PID 2456 wrote to memory of 2648	2456	rundll32.exe	68
PID 2456 wrote to memory of 2648	2456	rundll32.exe	68
PID 2648 wrote to memory of 2688	2648	rundll32.exe	69
PID 2648 wrote to memory of 2688	2648	rundll32.exe	69
PID 2648 wrote to memory of 2688	2648	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c5d68d8080fff28bdc7785e22e8155f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c5d68d8080fff28bdc7785e22e8155f.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\8c5d68d8080fff28bdc7785e22e8155f.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:2688

memory/2648-120-0x0000000010000000-0x0000000010028000-memory.dmp

Download