emotet | 7b3910cd5c947790823ce5cb5ed5778c2d642cb12c87ed6ad64d4eda55cf5375

Analysis

Target
68d6fa2e6a5c3afcd11c421644157cfe.dll
Size 259KB
Sample211118-bmtecsedh2
SHA256 7b3910cd5c947790823ce5cb5ed5778c2d642cb12c87ed6ad64d4eda55cf5375
MD5 68d6fa2e6a5c3afcd11c421644157cfe
SHA1 bfcf92f8efb0ba4bb7e4016f9d2875aba6fbfc3e
SHA512 7644423148a42a38e53de7b3809c8272f85f75251862ab5fc555aac9fc1ca65daccdc2b0f906e79a8d256001f526535a095367d623e920999d8c31f85389bd63
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	864	rundll32.exe
6	864	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
864	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 748	1952	rundll32.exe	27
PID 1952 wrote to memory of 748	1952	rundll32.exe	27
PID 1952 wrote to memory of 748	1952	rundll32.exe	27
PID 1952 wrote to memory of 748	1952	rundll32.exe	27
PID 1952 wrote to memory of 748	1952	rundll32.exe	27
PID 1952 wrote to memory of 748	1952	rundll32.exe	27
PID 1952 wrote to memory of 748	1952	rundll32.exe	27
PID 748 wrote to memory of 864	748	rundll32.exe	29
PID 748 wrote to memory of 864	748	rundll32.exe	29
PID 748 wrote to memory of 864	748	rundll32.exe	29
PID 748 wrote to memory of 864	748	rundll32.exe	29
PID 748 wrote to memory of 864	748	rundll32.exe	29
PID 748 wrote to memory of 864	748	rundll32.exe	29
PID 748 wrote to memory of 864	748	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\68d6fa2e6a5c3afcd11c421644157cfe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\68d6fa2e6a5c3afcd11c421644157cfe.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\68d6fa2e6a5c3afcd11c421644157cfe.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:864

memory/748-56-0x0000000075F41000-0x0000000075F43000-memory.dmp

Download

memory/748-59-0x0000000010000000-0x0000000010028000-memory.dmp

Download