emotet | 423bd5a167eeb14fee2d23ba0b6bbc6cfeb04193cdf60c3192a88187bee4e6ce

Analysis

Target
7f411b5e5b546cd096241570f39d02d7.dll
Size 384KB
Sample211203-2ghnsaheaj
SHA256 423bd5a167eeb14fee2d23ba0b6bbc6cfeb04193cdf60c3192a88187bee4e6ce
MD5 7f411b5e5b546cd096241570f39d02d7
SHA1 569d8c28818addbee4c95c161305b9eeafc5c378
SHA512 05adb5d061f0d5b2aa4b14e2caa535607a548cf797c6cdea26a3e00ea16f8872131e9e9b0c1f8f645d5d6898943a8c975297295c6d2b7abc03ebe1b93b8e5e4b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Blocklisted process makes network request 2 IoCs

flow	pid	Process
16	2580	rundll32.exe
17	2580	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2580	rundll32.exe
2580	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2716	3048	rundll32.exe	68
PID 3048 wrote to memory of 2716	3048	rundll32.exe	68
PID 3048 wrote to memory of 2716	3048	rundll32.exe	68
PID 2716 wrote to memory of 2580	2716	rundll32.exe	69
PID 2716 wrote to memory of 2580	2716	rundll32.exe	69
PID 2716 wrote to memory of 2580	2716	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f411b5e5b546cd096241570f39d02d7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f411b5e5b546cd096241570f39d02d7.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\7f411b5e5b546cd096241570f39d02d7.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:2580

memory/2580-123-0x0000000004900000-0x0000000004927000-memory.dmp

Download

memory/2580-126-0x0000000004EF0000-0x0000000004F17000-memory.dmp

Download

memory/2580-129-0x0000000004FE0000-0x0000000005007000-memory.dmp

Download

memory/2580-132-0x00000000050C0000-0x00000000050E7000-memory.dmp

Download

memory/2580-135-0x00000000051A0000-0x00000000051C7000-memory.dmp

Download

memory/2580-138-0x0000000005280000-0x00000000052A7000-memory.dmp

Download

memory/2716-120-0x0000000001250000-0x0000000001277000-memory.dmp

Download