emotet | 3563c9d1361cb4e8151a46084a33d15d2d9964e58c4df81f905ee2f9c99d082d

General

Target
145a3e1678b2367ac018f0d9e1bd9c73.dll
Size 416KB
Sample211124-s77adsdagn
SHA256 3563c9d1361cb4e8151a46084a33d15d2d9964e58c4df81f905ee2f9c99d082d
MD5 145a3e1678b2367ac018f0d9e1bd9c73
SHA1 8bd4dd0f0865a1f0dda3ba5afe703695b32a7c81
SHA512 33d17c98637ea0c6a8b7ad9d9216e01c3caaeb6d2a327df965b2126183d2a8469dce38487776e489c1c10330e418992e0b7478db2aea4c3ac4d72a9b6875032b
MD5 SHA1 SHA512

Score

10^/10

emotet banker suricata trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Blocklisted process makes network request 5 IoCs

flow	pid	Process
12	4204	rundll32.exe
13	4204	rundll32.exe
14	4204	rundll32.exe
29	4204	rundll32.exe
34	4204	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Yxvlexch\tnffixyyxdrzxw.wpm	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4204	rundll32.exe
4204	rundll32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4004	rundll32.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 3696	3548	rundll32.exe	69
PID 3548 wrote to memory of 3696	3548	rundll32.exe	69
PID 3548 wrote to memory of 3696	3548	rundll32.exe	69
PID 3696 wrote to memory of 3568	3696	rundll32.exe	70
PID 3696 wrote to memory of 3568	3696	rundll32.exe	70
PID 3696 wrote to memory of 3568	3696	rundll32.exe	70
PID 3568 wrote to memory of 4004	3568	rundll32.exe	71
PID 3568 wrote to memory of 4004	3568	rundll32.exe	71
PID 3568 wrote to memory of 4004	3568	rundll32.exe	71
PID 4004 wrote to memory of 4048	4004	rundll32.exe	72
PID 4004 wrote to memory of 4048	4004	rundll32.exe	72
PID 4004 wrote to memory of 4048	4004	rundll32.exe	72
PID 4048 wrote to memory of 3928	4048	rundll32.exe	73
PID 4048 wrote to memory of 3928	4048	rundll32.exe	73
PID 4048 wrote to memory of 3928	4048	rundll32.exe	73
PID 3928 wrote to memory of 4300	3928	rundll32.exe	74
PID 3928 wrote to memory of 4300	3928	rundll32.exe	74
PID 3928 wrote to memory of 4300	3928	rundll32.exe	74
PID 4300 wrote to memory of 4204	4300	rundll32.exe	75
PID 4300 wrote to memory of 4204	4300	rundll32.exe	75
PID 4300 wrote to memory of 4204	4300	rundll32.exe	75

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\145a3e1678b2367ac018f0d9e1bd9c73.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\145a3e1678b2367ac018f0d9e1bd9c73.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3696
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\145a3e1678b2367ac018f0d9e1bd9c73.dll,#1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3568
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\145a3e1678b2367ac018f0d9e1bd9c73.dll",Control_RunDLL
      4⤵
      Drops file in System32 directory
      Suspicious behavior: RenamesItself
      Suspicious use of WriteProcessMemory
      PID:4004
    - - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Yxvlexch\tnffixyyxdrzxw.wpm",HHMMVWupakmMxV
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4048
      - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Yxvlexch\tnffixyyxdrzxw.wpm",HHMMVWupakmMxV
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Yxvlexch\tnffixyyxdrzxw.wpm",Control_RunDLL
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4300
        
        C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Yxvlexch\tnffixyyxdrzxw.wpm",Control_RunDLL
        8⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        
        PID:4204

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3568-120-0x0000000010001000-0x0000000010024000-memory.dmp

Download

Analysis

Sharing