emotet | 3a8acc008eaad0a94e3b5fbd200028fa342773869b3f7f7edf772adbfb52d789

Analysis

Target
3a8acc008eaad0a94e3b5fbd200028fa342773869b3f7f7edf772adbfb52d789.dll
Size 416KB
Sample211124-s2g4bagcb6
SHA256 3a8acc008eaad0a94e3b5fbd200028fa342773869b3f7f7edf772adbfb52d789
MD5 b65325cbe036c4e86a94428d8e7fab49
SHA1 8788e13d2a0fad0a31f5a48613d2fcbd521d0d2e
SHA512 47878f9d331163c0729302a1d254be7d06e5a385261e575b0764693714c3c91a1a627c6b968594b8b71406bb1475ec510487d1596540ac1c5c48734f94aa188f
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 6 IoCs

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3164	rundll32.exe
3164	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2952	2784	rundll32.exe	68
PID 2784 wrote to memory of 2952	2784	rundll32.exe	68
PID 2784 wrote to memory of 2952	2784	rundll32.exe	68
PID 2952 wrote to memory of 3864	2952	rundll32.exe	69
PID 2952 wrote to memory of 3864	2952	rundll32.exe	69
PID 2952 wrote to memory of 3864	2952	rundll32.exe	69
PID 3864 wrote to memory of 3164	3864	rundll32.exe	70
PID 3864 wrote to memory of 3164	3864	rundll32.exe	70
PID 3864 wrote to memory of 3164	3864	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a8acc008eaad0a94e3b5fbd200028fa342773869b3f7f7edf772adbfb52d789.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a8acc008eaad0a94e3b5fbd200028fa342773869b3f7f7edf772adbfb52d789.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a8acc008eaad0a94e3b5fbd200028fa342773869b3f7f7edf772adbfb52d789.dll,#1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3864
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\3a8acc008eaad0a94e3b5fbd200028fa342773869b3f7f7edf772adbfb52d789.dll",Control_RunDLL
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      PID:3164

memory/3864-117-0x0000000010001000-0x0000000010024000-memory.dmp

Download