emotet | 6bb09175483f33f93120573304b698ebfb93ea4a1cfa19f116faf214e720c3e4

Analysis

Target
5e6b17d35d2e0e8ab1f6280aca882777.dll
Size 259KB
Sample211118-al7d6aedd4
SHA256 6bb09175483f33f93120573304b698ebfb93ea4a1cfa19f116faf214e720c3e4
MD5 5e6b17d35d2e0e8ab1f6280aca882777
SHA1 e65d08b72ba69d8314e3e0403176372436b4421c
SHA512 a8ac6642eafa5038ed09c03c68eaa11a9030ff27a5467f0a258fc7409c342784fc4cad8d0bcdef3d4ffb8120a2544806b4aea5dd185e1a7ba46552b896248163
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	3124	rundll32.exe
11	3124	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3124	rundll32.exe
3124	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1876	1744	rundll32.exe	68
PID 1744 wrote to memory of 1876	1744	rundll32.exe	68
PID 1744 wrote to memory of 1876	1744	rundll32.exe	68
PID 1876 wrote to memory of 3124	1876	rundll32.exe	69
PID 1876 wrote to memory of 3124	1876	rundll32.exe	69
PID 1876 wrote to memory of 3124	1876	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e6b17d35d2e0e8ab1f6280aca882777.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e6b17d35d2e0e8ab1f6280aca882777.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5e6b17d35d2e0e8ab1f6280aca882777.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3124

memory/1876-117-0x0000000010000000-0x0000000010028000-memory.dmp

Download