emotet | 26099e7fa189669812ed5117ae4f85463505e563eeece64c085bb8d0ff01ea65

Analysis

Target
emotet_exe_e5_0e97059a25d9b4e7835814386627e8570074969e81058690204c2550faf32972_2021-12-17__181241.exe.dll
Size 653KB
Sample211217-wtql9seac8
SHA256 26099e7fa189669812ed5117ae4f85463505e563eeece64c085bb8d0ff01ea65
MD5 7ffc8b580689321818b47c53a3faefcc
SHA1 ea57ba3db0f0c774e6acb6e25a72dfdda5ec2607
SHA512 f205a54ee6f94fddf22786056e2372f4878c8cbd5b3917649303a0c7024a7d347263b9c0635c67baccb2fe79431365fc6bcbc3cc9727252ce06011b7ff6d17d4
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 2 IoCs

flow	pid	Process
23	3128	rundll32.exe
24	3128	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3128	rundll32.exe
3128	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2116	2688	rundll32.exe	68
PID 2688 wrote to memory of 2116	2688	rundll32.exe	68
PID 2688 wrote to memory of 2116	2688	rundll32.exe	68
PID 2116 wrote to memory of 3128	2116	rundll32.exe	69
PID 2116 wrote to memory of 3128	2116	rundll32.exe	69
PID 2116 wrote to memory of 3128	2116	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0e97059a25d9b4e7835814386627e8570074969e81058690204c2550faf32972_2021-12-17__181241.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0e97059a25d9b4e7835814386627e8570074969e81058690204c2550faf32972_2021-12-17__181241.exe.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0e97059a25d9b4e7835814386627e8570074969e81058690204c2550faf32972_2021-12-17__181241.exe.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3128

memory/2116-116-0x00000000032E0000-0x0000000003308000-memory.dmp

Download

memory/3128-120-0x0000000000ED0000-0x0000000000EF8000-memory.dmp

Download

memory/3128-123-0x0000000004E90000-0x0000000004EB8000-memory.dmp

Download

memory/3128-126-0x0000000005090000-0x00000000050B8000-memory.dmp

Download

memory/3128-129-0x0000000005170000-0x0000000005198000-memory.dmp

Download

memory/3128-132-0x0000000005250000-0x0000000005278000-memory.dmp

Download

memory/3128-135-0x0000000005330000-0x0000000005358000-memory.dmp

Download