emotet | ffd90dec5a531afabd4e63a87b029c829404f83454d43de5bae0cc97912f25fc

Analysis

Target
VZZdgPFp2xiOJtfpv.dll
Size 364KB
Sample211202-sjfgrsaacn
SHA256 ffd90dec5a531afabd4e63a87b029c829404f83454d43de5bae0cc97912f25fc
MD5 a328c761d2f253534919bff4fb3c89b4
SHA1 3186f77c6e45d7d61a678c34f09d8d2bde35df1a
SHA512 edbac403fc72ed679599f2000fce047205329930c33eeb1ac74d12bc8967e9a317997da7a734524bb04a9022329309cf619b0c82e2b14d300c87a8309acdc8b1
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	680	rundll32.exe
6	680	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
680	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1888	1520	rundll32.exe	27
PID 1520 wrote to memory of 1888	1520	rundll32.exe	27
PID 1520 wrote to memory of 1888	1520	rundll32.exe	27
PID 1520 wrote to memory of 1888	1520	rundll32.exe	27
PID 1520 wrote to memory of 1888	1520	rundll32.exe	27
PID 1520 wrote to memory of 1888	1520	rundll32.exe	27
PID 1520 wrote to memory of 1888	1520	rundll32.exe	27
PID 1888 wrote to memory of 680	1888	rundll32.exe	29
PID 1888 wrote to memory of 680	1888	rundll32.exe	29
PID 1888 wrote to memory of 680	1888	rundll32.exe	29
PID 1888 wrote to memory of 680	1888	rundll32.exe	29
PID 1888 wrote to memory of 680	1888	rundll32.exe	29
PID 1888 wrote to memory of 680	1888	rundll32.exe	29
PID 1888 wrote to memory of 680	1888	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VZZdgPFp2xiOJtfpv.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\VZZdgPFp2xiOJtfpv.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VZZdgPFp2xiOJtfpv.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:680

memory/680-60-0x00000000001E0000-0x0000000000207000-memory.dmp

Download

memory/1888-56-0x00000000753E1000-0x00000000753E3000-memory.dmp

Download

memory/1888-59-0x00000000000B0000-0x00000000000D7000-memory.dmp

Download