emotet | 1ce1a76dde0487b9991dca85f8cf3901628a52a9314f3d517edcccd2f6155d12

Analysis

Target
048aa4c19c859df0d59227721858a8db.dll
Size 527KB
Sample211126-cdt5zadbd2
SHA256 1ce1a76dde0487b9991dca85f8cf3901628a52a9314f3d517edcccd2f6155d12
MD5 048aa4c19c859df0d59227721858a8db
SHA1 3b22ffe82a1ef5f7f0b20011b33536d32552c151
SHA512 c9db4c0ad271c69e6694d2dcdc834dd5982ec5d24bbea7249f2bb26e0bb6475974b5dc63efa3941cd2d9118883866e4209e129f171e9299048282f99d6bd04bc
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 3 IoCs

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1564	rundll32.exe
1564	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2680	2668	rundll32.exe	68
PID 2668 wrote to memory of 2680	2668	rundll32.exe	68
PID 2668 wrote to memory of 2680	2668	rundll32.exe	68
PID 2680 wrote to memory of 1564	2680	rundll32.exe	69
PID 2680 wrote to memory of 1564	2680	rundll32.exe	69
PID 2680 wrote to memory of 1564	2680	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\048aa4c19c859df0d59227721858a8db.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\048aa4c19c859df0d59227721858a8db.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\048aa4c19c859df0d59227721858a8db.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:1564

memory/1564-123-0x0000000000850000-0x0000000000878000-memory.dmp

Download

memory/1564-126-0x00000000041F0000-0x0000000004218000-memory.dmp

Download

memory/1564-129-0x00000000043E0000-0x0000000004408000-memory.dmp

Download

memory/1564-132-0x0000000004830000-0x0000000004858000-memory.dmp

Download

memory/1564-135-0x0000000004910000-0x0000000004938000-memory.dmp

Download

memory/1564-138-0x0000000004B10000-0x0000000004B38000-memory.dmp

Download

memory/2680-119-0x00000000034A0000-0x00000000034C8000-memory.dmp

Download