emotet | 201ab94c2ca17f69b02b0b9038ddbd2fd3d56252ceaf385e5df4736f93bfa83d

Analysis

Target
emotet_exe_e5_201ab94c2ca17f69b02b0b9038ddbd2fd3d56252ceaf385e5df4736f93bfa83d_2021-12-02__000707.exe.dll
Size 364KB
Sample211202-aexldahbbp
SHA256 201ab94c2ca17f69b02b0b9038ddbd2fd3d56252ceaf385e5df4736f93bfa83d
MD5 d342140a684d2fd859a44a26d75b597f
SHA1 3c8d49eb743e1d7e98a534e18e36d119eb787d16
SHA512 2caed481a9dfc5604fe46459d80983ad54e217bca20cc208591f3bb798cbbf4114315bf8dc0e35181d5a77b4acbec68f04ad2ff52731c9373e66066c2e8b1ab0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Blocklisted process makes network request 2 IoCs

flow	pid	Process
38	2636	rundll32.exe
40	2636	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2636	rundll32.exe
2636	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 3124	3832	rundll32.exe	68
PID 3832 wrote to memory of 3124	3832	rundll32.exe	68
PID 3832 wrote to memory of 3124	3832	rundll32.exe	68
PID 3124 wrote to memory of 2636	3124	rundll32.exe	69
PID 3124 wrote to memory of 2636	3124	rundll32.exe	69
PID 3124 wrote to memory of 2636	3124	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_201ab94c2ca17f69b02b0b9038ddbd2fd3d56252ceaf385e5df4736f93bfa83d_2021-12-02__000707.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_201ab94c2ca17f69b02b0b9038ddbd2fd3d56252ceaf385e5df4736f93bfa83d_2021-12-02__000707.exe.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_201ab94c2ca17f69b02b0b9038ddbd2fd3d56252ceaf385e5df4736f93bfa83d_2021-12-02__000707.exe.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:2636

memory/2636-121-0x0000000000F70000-0x000000000101E000-memory.dmp

Download

memory/3124-120-0x0000000003060000-0x00000000031AA000-memory.dmp

Download