emotet | bf0cadbc8a6b28a54eb0db5f2afe582a02d5f1dedb058097abc1d7b43ba7deb0

Analysis

Target
56547488fb182b73f83211903ce2dd30.dll
Size 416KB
Sample211124-s3l4nagcc2
SHA256 bf0cadbc8a6b28a54eb0db5f2afe582a02d5f1dedb058097abc1d7b43ba7deb0
MD5 56547488fb182b73f83211903ce2dd30
SHA1 e3c962932fb99e7685ea989356d60afc4045c52f
SHA512 f1d4ae06426e597af23e21d97946812d9bb7d546687cd53b8efec73a82216f998e9c4f7556cf6791aa1b3d32787c57056777a3bde6563ac5b7b51b48f0455dce
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 6 IoCs

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4088	rundll32.exe
4088	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 3500	3044	rundll32.exe	68
PID 3044 wrote to memory of 3500	3044	rundll32.exe	68
PID 3044 wrote to memory of 3500	3044	rundll32.exe	68
PID 3500 wrote to memory of 2532	3500	rundll32.exe	69
PID 3500 wrote to memory of 2532	3500	rundll32.exe	69
PID 3500 wrote to memory of 2532	3500	rundll32.exe	69
PID 2532 wrote to memory of 4088	2532	rundll32.exe	70
PID 2532 wrote to memory of 4088	2532	rundll32.exe	70
PID 2532 wrote to memory of 4088	2532	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\56547488fb182b73f83211903ce2dd30.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\56547488fb182b73f83211903ce2dd30.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\56547488fb182b73f83211903ce2dd30.dll,#1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\56547488fb182b73f83211903ce2dd30.dll",Control_RunDLL
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      PID:4088

memory/2532-117-0x0000000010001000-0x0000000010024000-memory.dmp

Download