emotet | c017e8cb9e1758e2142f926bc55e990559a4ddbfbfd9cbc1c3e39ca63e72c3ae

Analysis

Target
emotet_exe_e5_c017e8cb9e1758e2142f926bc55e990559a4ddbfbfd9cbc1c3e39ca63e72c3ae_2021-12-02__000709.exe.dll
Size 364KB
Sample211202-aexw5sccd5
SHA256 c017e8cb9e1758e2142f926bc55e990559a4ddbfbfd9cbc1c3e39ca63e72c3ae
MD5 10105d7ca3db00a4a7116fc1208b3101
SHA1 e375cb70111d59210f7844f6b16e3f99060317ac
SHA512 209fdde60a4dbd6e8edc7cc5037b3a270b8a049a86ff0b89b3ea674b8ca60ec99a88154358ff9d818df973c2c6ee7588e91a40a5258fd7f8dc61b2162272a8f7
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 2 IoCs

flow	pid	Process
37	2000	rundll32.exe
39	2000	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2000	rundll32.exe
2000	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 3032	2824	rundll32.exe	68
PID 2824 wrote to memory of 3032	2824	rundll32.exe	68
PID 2824 wrote to memory of 3032	2824	rundll32.exe	68
PID 3032 wrote to memory of 2000	3032	rundll32.exe	69
PID 3032 wrote to memory of 2000	3032	rundll32.exe	69
PID 3032 wrote to memory of 2000	3032	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c017e8cb9e1758e2142f926bc55e990559a4ddbfbfd9cbc1c3e39ca63e72c3ae_2021-12-02__000709.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c017e8cb9e1758e2142f926bc55e990559a4ddbfbfd9cbc1c3e39ca63e72c3ae_2021-12-02__000709.exe.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c017e8cb9e1758e2142f926bc55e990559a4ddbfbfd9cbc1c3e39ca63e72c3ae_2021-12-02__000709.exe.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:2000

memory/2000-118-0x0000000003300000-0x0000000003327000-memory.dmp

Download

memory/3032-117-0x0000000003100000-0x000000000324A000-memory.dmp

Download