emotet | 7b3910cd5c947790823ce5cb5ed5778c2d642cb12c87ed6ad64d4eda55cf5375

Analysis

Target
68d6fa2e6a5c3afcd11c421644157cfe.dll
Size 259KB
Sample211118-bmtecsedh2
SHA256 7b3910cd5c947790823ce5cb5ed5778c2d642cb12c87ed6ad64d4eda55cf5375
MD5 68d6fa2e6a5c3afcd11c421644157cfe
SHA1 bfcf92f8efb0ba4bb7e4016f9d2875aba6fbfc3e
SHA512 7644423148a42a38e53de7b3809c8272f85f75251862ab5fc555aac9fc1ca65daccdc2b0f906e79a8d256001f526535a095367d623e920999d8c31f85389bd63
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 2 IoCs

flow	pid	Process
17	2548	rundll32.exe
19	2548	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2548	rundll32.exe
2548	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 3820	2164	rundll32.exe	68
PID 2164 wrote to memory of 3820	2164	rundll32.exe	68
PID 2164 wrote to memory of 3820	2164	rundll32.exe	68
PID 3820 wrote to memory of 2548	3820	rundll32.exe	69
PID 3820 wrote to memory of 2548	3820	rundll32.exe	69
PID 3820 wrote to memory of 2548	3820	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\68d6fa2e6a5c3afcd11c421644157cfe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\68d6fa2e6a5c3afcd11c421644157cfe.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\68d6fa2e6a5c3afcd11c421644157cfe.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:2548

memory/3820-120-0x0000000010000000-0x0000000010028000-memory.dmp

Download