emotet | fa32057ace2dfe1cfd5918cfe9b666e5e3ed3e269f8393a0ef174819a6465a30

Analysis

Target
emotet_exe_e5_fa32057ace2dfe1cfd5918cfe9b666e5e3ed3e269f8393a0ef174819a6465a30_2021-11-30__163052.exe.dll
Size 624KB
Sample211130-t1c9eafebp
SHA256 fa32057ace2dfe1cfd5918cfe9b666e5e3ed3e269f8393a0ef174819a6465a30
MD5 8268d7d4dfc198ad17f8126445b52f5e
SHA1 f1cb5f6a9e742b9b15d911cb9ec93bf103578925
SHA512 7deeed3d3a2b095921575d94c95214b0821d92921d65fd7e06dfbcdbd0b191663fb8458abf5f371c8daa17ecffa8e6204947e73e93d68055ed7b2d53e8930236
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Blocklisted process makes network request 2 IoCs

flow	pid	Process
16	3284	rundll32.exe
17	3284	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3284	rundll32.exe
3284	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 2136	3804	rundll32.exe	68
PID 3804 wrote to memory of 2136	3804	rundll32.exe	68
PID 3804 wrote to memory of 2136	3804	rundll32.exe	68
PID 2136 wrote to memory of 3284	2136	rundll32.exe	69
PID 2136 wrote to memory of 3284	2136	rundll32.exe	69
PID 2136 wrote to memory of 3284	2136	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_fa32057ace2dfe1cfd5918cfe9b666e5e3ed3e269f8393a0ef174819a6465a30_2021-11-30__163052.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_fa32057ace2dfe1cfd5918cfe9b666e5e3ed3e269f8393a0ef174819a6465a30_2021-11-30__163052.exe.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_fa32057ace2dfe1cfd5918cfe9b666e5e3ed3e269f8393a0ef174819a6465a30_2021-11-30__163052.exe.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3284

memory/2136-119-0x0000000004800000-0x0000000004827000-memory.dmp

Download

memory/3284-123-0x0000000004E10000-0x0000000004E37000-memory.dmp

Download

memory/3284-126-0x0000000004F00000-0x0000000004F27000-memory.dmp

Download

memory/3284-129-0x00000000053F0000-0x0000000005417000-memory.dmp

Download

memory/3284-132-0x00000000056E0000-0x0000000005707000-memory.dmp

Download

memory/3284-135-0x00000000057C0000-0x00000000057E7000-memory.dmp

Download

memory/3284-138-0x00000000058B0000-0x00000000058D7000-memory.dmp

Download