emotet | 201ab94c2ca17f69b02b0b9038ddbd2fd3d56252ceaf385e5df4736f93bfa83d

Analysis

Target
emotet_exe_e5_201ab94c2ca17f69b02b0b9038ddbd2fd3d56252ceaf385e5df4736f93bfa83d_2021-12-02__000707.exe.dll
Size 364KB
Sample211202-aexldahbbp
SHA256 201ab94c2ca17f69b02b0b9038ddbd2fd3d56252ceaf385e5df4736f93bfa83d
MD5 d342140a684d2fd859a44a26d75b597f
SHA1 3c8d49eb743e1d7e98a534e18e36d119eb787d16
SHA512 2caed481a9dfc5604fe46459d80983ad54e217bca20cc208591f3bb798cbbf4114315bf8dc0e35181d5a77b4acbec68f04ad2ff52731c9373e66066c2e8b1ab0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	552	rundll32.exe
6	552	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
552	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 1308	780	rundll32.exe	28
PID 780 wrote to memory of 1308	780	rundll32.exe	28
PID 780 wrote to memory of 1308	780	rundll32.exe	28
PID 780 wrote to memory of 1308	780	rundll32.exe	28
PID 780 wrote to memory of 1308	780	rundll32.exe	28
PID 780 wrote to memory of 1308	780	rundll32.exe	28
PID 780 wrote to memory of 1308	780	rundll32.exe	28
PID 1308 wrote to memory of 552	1308	rundll32.exe	29
PID 1308 wrote to memory of 552	1308	rundll32.exe	29
PID 1308 wrote to memory of 552	1308	rundll32.exe	29
PID 1308 wrote to memory of 552	1308	rundll32.exe	29
PID 1308 wrote to memory of 552	1308	rundll32.exe	29
PID 1308 wrote to memory of 552	1308	rundll32.exe	29
PID 1308 wrote to memory of 552	1308	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_201ab94c2ca17f69b02b0b9038ddbd2fd3d56252ceaf385e5df4736f93bfa83d_2021-12-02__000707.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_201ab94c2ca17f69b02b0b9038ddbd2fd3d56252ceaf385e5df4736f93bfa83d_2021-12-02__000707.exe.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_201ab94c2ca17f69b02b0b9038ddbd2fd3d56252ceaf385e5df4736f93bfa83d_2021-12-02__000707.exe.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:552

memory/552-60-0x0000000000120000-0x0000000000147000-memory.dmp

Download

memory/1308-56-0x0000000075981000-0x0000000075983000-memory.dmp

Download

memory/1308-59-0x0000000000190000-0x00000000001B7000-memory.dmp

Download