emotet | b2565f55e5ceafaac0a7185bfb24b50650f067f5cc5f86b6a52edc1765cf705a

Analysis

Target
65f6217ab793057fe297151b7b24ebc5.dll
Size 252KB
Sample211118-al7d6abddp
SHA256 b2565f55e5ceafaac0a7185bfb24b50650f067f5cc5f86b6a52edc1765cf705a
MD5 65f6217ab793057fe297151b7b24ebc5
SHA1 a64a9d73e1d94a30d65e588ce3d26ff086907c21
SHA512 5f81830a0b20e961965514ddd3fe99f1c255ff4355109cc6313753f10b85eb199b63c72d134c729cdcfdc68912967a93383014aac22a113e6b2febe3dd1b843a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Blocklisted process makes network request 2 IoCs

flow	pid	Process
12	4104	rundll32.exe
13	4104	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4104	rundll32.exe
4104	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 2860	4392	rundll32.exe	68
PID 4392 wrote to memory of 2860	4392	rundll32.exe	68
PID 4392 wrote to memory of 2860	4392	rundll32.exe	68
PID 2860 wrote to memory of 4104	2860	rundll32.exe	69
PID 2860 wrote to memory of 4104	2860	rundll32.exe	69
PID 2860 wrote to memory of 4104	2860	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65f6217ab793057fe297151b7b24ebc5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\65f6217ab793057fe297151b7b24ebc5.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\65f6217ab793057fe297151b7b24ebc5.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:4104

memory/2860-117-0x0000000010000000-0x0000000010028000-memory.dmp

Download