emotet | b4677fd1abda9602ca41861ffec9a6b2e7415e2174b995d662f7d7a9c787cbec

Analysis

Target
c5c1579c90cbd900d23c7f9360a6dc2a.dll
Size 259KB
Sample211118-bkh6lsbdgn
SHA256 b4677fd1abda9602ca41861ffec9a6b2e7415e2174b995d662f7d7a9c787cbec
MD5 c5c1579c90cbd900d23c7f9360a6dc2a
SHA1 5b353608d41055dc6029586d69756a5d033d9cf1
SHA512 e804eaac45ca71460245ae9b49ec0bf47b4e876787447596a2f24173eb124b61e0e513b8516b9a7ba73989e63bf4157a8afc661318c283793b24762d5038c1ef
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Blocklisted process makes network request 2 IoCs

flow	pid	Process
16	2684	rundll32.exe
17	2684	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2684	rundll32.exe
2684	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2660	2640	rundll32.exe	68
PID 2640 wrote to memory of 2660	2640	rundll32.exe	68
PID 2640 wrote to memory of 2660	2640	rundll32.exe	68
PID 2660 wrote to memory of 2684	2660	rundll32.exe	69
PID 2660 wrote to memory of 2684	2660	rundll32.exe	69
PID 2660 wrote to memory of 2684	2660	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5c1579c90cbd900d23c7f9360a6dc2a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5c1579c90cbd900d23c7f9360a6dc2a.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\c5c1579c90cbd900d23c7f9360a6dc2a.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:2684

memory/2660-120-0x0000000010000000-0x0000000010028000-memory.dmp

Download