emotet | 17fffa76beaea9c2db0136a06fcd6ac60b9934b017ef9ba3f8fde9e7e5fa337f

Analysis

Target
124684af987f6c5aaf265c81c2bf8e19.dll
Size 259KB
Sample211118-acqp2sbdbm
SHA256 17fffa76beaea9c2db0136a06fcd6ac60b9934b017ef9ba3f8fde9e7e5fa337f
MD5 124684af987f6c5aaf265c81c2bf8e19
SHA1 81148f5ef226de862e37db27b6406ca553ddae34
SHA512 ba577f5d8a386b58a2232ad479921dc71be867c051a27f1655c4bbb4763f73d2f34a09345dceb89d51535e653f78cb3626bdb20e769677a7e501d4f6711ec928
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Blocklisted process makes network request 2 IoCs

flow	pid	Process
16	3840	rundll32.exe
18	3840	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3840	rundll32.exe
3840	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2744	2728	rundll32.exe	68
PID 2728 wrote to memory of 2744	2728	rundll32.exe	68
PID 2728 wrote to memory of 2744	2728	rundll32.exe	68
PID 2744 wrote to memory of 3840	2744	rundll32.exe	69
PID 2744 wrote to memory of 3840	2744	rundll32.exe	69
PID 2744 wrote to memory of 3840	2744	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\124684af987f6c5aaf265c81c2bf8e19.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\124684af987f6c5aaf265c81c2bf8e19.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\124684af987f6c5aaf265c81c2bf8e19.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3840

memory/2744-117-0x0000000010000000-0x0000000010028000-memory.dmp

Download