emotet | ffd90dec5a531afabd4e63a87b029c829404f83454d43de5bae0cc97912f25fc

Analysis

Target
VZZdgPFp2xiOJtfpv.dll
Size 364KB
Sample211202-sjfgrsaacn
SHA256 ffd90dec5a531afabd4e63a87b029c829404f83454d43de5bae0cc97912f25fc
MD5 a328c761d2f253534919bff4fb3c89b4
SHA1 3186f77c6e45d7d61a678c34f09d8d2bde35df1a
SHA512 edbac403fc72ed679599f2000fce047205329930c33eeb1ac74d12bc8967e9a317997da7a734524bb04a9022329309cf619b0c82e2b14d300c87a8309acdc8b1
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Blocklisted process makes network request 2 IoCs

flow	pid	Process
39	4428	rundll32.exe
40	4428	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4428	rundll32.exe
4428	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 4044	3628	rundll32.exe	68
PID 3628 wrote to memory of 4044	3628	rundll32.exe	68
PID 3628 wrote to memory of 4044	3628	rundll32.exe	68
PID 4044 wrote to memory of 4428	4044	rundll32.exe	69
PID 4044 wrote to memory of 4428	4044	rundll32.exe	69
PID 4044 wrote to memory of 4428	4044	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VZZdgPFp2xiOJtfpv.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\VZZdgPFp2xiOJtfpv.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4044
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VZZdgPFp2xiOJtfpv.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:4428

memory/4044-120-0x0000000000650000-0x000000000079A000-memory.dmp

Download

memory/4428-121-0x0000000000400000-0x0000000000427000-memory.dmp

Download