emotet | 461c97779dfaa67673db5000da20e62efe73d480e25727444a3fb799c0594cba

Analysis

Target
emotet_exe_e5_461c97779dfaa67673db5000da20e62efe73d480e25727444a3fb799c0594cba_2021-12-01__222205.exe.dll
Size 364KB
Sample211201-2ar9msgdhj
SHA256 461c97779dfaa67673db5000da20e62efe73d480e25727444a3fb799c0594cba
MD5 aedea9f87fca7fcbe5782ff6d538e3ce
SHA1 d6f7876a1b846ce821b5d92878f739896902c92a
SHA512 ad94ea7037876a94b0e735b6b88a4d6c4497bb4827f180351497848938ad70ac032dee564de32a8101d511803e27c753cc3e1aaa2efde4532cdd47df31a70f4b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Blocklisted process makes network request 2 IoCs

flow	pid	Process
23	1516	rundll32.exe
24	1516	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1516	rundll32.exe
1516	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 2824	2788	rundll32.exe	68
PID 2788 wrote to memory of 2824	2788	rundll32.exe	68
PID 2788 wrote to memory of 2824	2788	rundll32.exe	68
PID 2824 wrote to memory of 1516	2824	rundll32.exe	70
PID 2824 wrote to memory of 1516	2824	rundll32.exe	70
PID 2824 wrote to memory of 1516	2824	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_461c97779dfaa67673db5000da20e62efe73d480e25727444a3fb799c0594cba_2021-12-01__222205.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_461c97779dfaa67673db5000da20e62efe73d480e25727444a3fb799c0594cba_2021-12-01__222205.exe.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_461c97779dfaa67673db5000da20e62efe73d480e25727444a3fb799c0594cba_2021-12-01__222205.exe.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:1516

memory/1516-121-0x0000000000440000-0x0000000000467000-memory.dmp

Download

memory/2824-120-0x0000000004580000-0x00000000045A7000-memory.dmp

Download