emotet | b4677fd1abda9602ca41861ffec9a6b2e7415e2174b995d662f7d7a9c787cbec

Analysis

Target
c5c1579c90cbd900d23c7f9360a6dc2a.dll
Size 259KB
Sample211118-bkh6lsbdgn
SHA256 b4677fd1abda9602ca41861ffec9a6b2e7415e2174b995d662f7d7a9c787cbec
MD5 c5c1579c90cbd900d23c7f9360a6dc2a
SHA1 5b353608d41055dc6029586d69756a5d033d9cf1
SHA512 e804eaac45ca71460245ae9b49ec0bf47b4e876787447596a2f24173eb124b61e0e513b8516b9a7ba73989e63bf4157a8afc661318c283793b24762d5038c1ef
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	692	rundll32.exe
6	692	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
692	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 1040	760	rundll32.exe	28
PID 760 wrote to memory of 1040	760	rundll32.exe	28
PID 760 wrote to memory of 1040	760	rundll32.exe	28
PID 760 wrote to memory of 1040	760	rundll32.exe	28
PID 760 wrote to memory of 1040	760	rundll32.exe	28
PID 760 wrote to memory of 1040	760	rundll32.exe	28
PID 760 wrote to memory of 1040	760	rundll32.exe	28
PID 1040 wrote to memory of 692	1040	rundll32.exe	29
PID 1040 wrote to memory of 692	1040	rundll32.exe	29
PID 1040 wrote to memory of 692	1040	rundll32.exe	29
PID 1040 wrote to memory of 692	1040	rundll32.exe	29
PID 1040 wrote to memory of 692	1040	rundll32.exe	29
PID 1040 wrote to memory of 692	1040	rundll32.exe	29
PID 1040 wrote to memory of 692	1040	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5c1579c90cbd900d23c7f9360a6dc2a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5c1579c90cbd900d23c7f9360a6dc2a.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\c5c1579c90cbd900d23c7f9360a6dc2a.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:692

memory/1040-56-0x00000000764D1000-0x00000000764D3000-memory.dmp

Download

memory/1040-59-0x0000000010000000-0x0000000010028000-memory.dmp

Download