emotet | e2b526c30e07cd23b44fd9c4897a4ca1cc2df99e9e441a23f6fa609b06389132

Analysis

Target
emotet_exe_e5_e2b526c30e07cd23b44fd9c4897a4ca1cc2df99e9e441a23f6fa609b06389132_2021-12-01__222206.exe.dll
Size 364KB
Sample211201-2askeagdhm
SHA256 e2b526c30e07cd23b44fd9c4897a4ca1cc2df99e9e441a23f6fa609b06389132
MD5 c16f159538f3f31eeb7b1a6686b21a8e
SHA1 453383dd3ad0bb6f0820ead807bf7acfede88f4a
SHA512 f2e74cedbb6a2aad268c7a24de61a223c064be8d39d25e593f1986a576701b6d6cc93ce5dc489a7ae8247b74727c49d016d4a388903be422d86f4c4fb8ad177f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Blocklisted process makes network request 2 IoCs

flow	pid	Process
29	912	rundll32.exe
30	912	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
912	rundll32.exe
912	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2336	2776	rundll32.exe	68
PID 2776 wrote to memory of 2336	2776	rundll32.exe	68
PID 2776 wrote to memory of 2336	2776	rundll32.exe	68
PID 2336 wrote to memory of 912	2336	rundll32.exe	69
PID 2336 wrote to memory of 912	2336	rundll32.exe	69
PID 2336 wrote to memory of 912	2336	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e2b526c30e07cd23b44fd9c4897a4ca1cc2df99e9e441a23f6fa609b06389132_2021-12-01__222206.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e2b526c30e07cd23b44fd9c4897a4ca1cc2df99e9e441a23f6fa609b06389132_2021-12-01__222206.exe.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e2b526c30e07cd23b44fd9c4897a4ca1cc2df99e9e441a23f6fa609b06389132_2021-12-01__222206.exe.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:912

memory/912-118-0x0000000000940000-0x00000000009EE000-memory.dmp

Download

memory/2336-117-0x0000000000710000-0x0000000000737000-memory.dmp

Download