emotet | bd7e6fa162b8344d51b417a9b6547095b2565d223f200025491350a317baaaa9

Analysis

Target
ffd3629104a581cbb1349007a5c52590.dll
Size 696KB
Sample211201-cdvfqscga4
SHA256 bd7e6fa162b8344d51b417a9b6547095b2565d223f200025491350a317baaaa9
MD5 ffd3629104a581cbb1349007a5c52590
SHA1 1dfef6b2af7e2a357a413e05ba48a2c522ba172b
SHA512 dcd16186d8bf738cafbdbe15d3be1548e191efbd166071c9f4281ccfa18ccf02fbc88396a4f391a4f85c3255d819f20f5a9c71eafd322439438ac663c9843efd
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 3 IoCs

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3772	rundll32.exe
3772	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 2812	2788	rundll32.exe	68
PID 2788 wrote to memory of 2812	2788	rundll32.exe	68
PID 2788 wrote to memory of 2812	2788	rundll32.exe	68
PID 2812 wrote to memory of 3772	2812	rundll32.exe	69
PID 2812 wrote to memory of 3772	2812	rundll32.exe	69
PID 2812 wrote to memory of 3772	2812	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffd3629104a581cbb1349007a5c52590.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffd3629104a581cbb1349007a5c52590.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ffd3629104a581cbb1349007a5c52590.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3772

memory/2812-119-0x0000000000CD0000-0x0000000000CF8000-memory.dmp

Download

memory/3772-123-0x0000000000E60000-0x0000000000E88000-memory.dmp

Download

memory/3772-126-0x00000000011F0000-0x0000000001218000-memory.dmp

Download

memory/3772-129-0x0000000004B30000-0x0000000004B58000-memory.dmp

Download

memory/3772-132-0x0000000004C10000-0x0000000004C38000-memory.dmp

Download

memory/3772-135-0x0000000004CF0000-0x0000000004D18000-memory.dmp

Download

memory/3772-138-0x0000000004DD0000-0x0000000004DF8000-memory.dmp

Download