emotet | 8d3113a021d813389f73c4161d00eda8f4b11ff11b4dd175bf3c76b08ce83b41

Analysis

Target
emotet_exe_e4_476cc2523f5745af2f5ab4de4fe8a96a106af2a796c222c572ede39bafd39fff_2022-01-04__042339.exe.dll
Size 527KB
Sample220104-e1d4dafga3
SHA256 8d3113a021d813389f73c4161d00eda8f4b11ff11b4dd175bf3c76b08ce83b41
MD5 c1bb8bde4df7bf942a93657c091a0454
SHA1 cdcdb3cd01cde8b1b1316638cecbb6d8406fb7ac
SHA512 f7a4e55038c06b9d68207a729383d2b829e18909058a68e8d47085d9667a195d9db8cf38a49bfaa9861276149366fc8e958182e53b0730cdcfe10c7ed173915d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 10 IoCs

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1720	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 1796	1192	rundll32.exe	27
PID 1192 wrote to memory of 1796	1192	rundll32.exe	27
PID 1192 wrote to memory of 1796	1192	rundll32.exe	27
PID 1192 wrote to memory of 1796	1192	rundll32.exe	27
PID 1192 wrote to memory of 1796	1192	rundll32.exe	27
PID 1192 wrote to memory of 1796	1192	rundll32.exe	27
PID 1192 wrote to memory of 1796	1192	rundll32.exe	27
PID 1796 wrote to memory of 1720	1796	rundll32.exe	28
PID 1796 wrote to memory of 1720	1796	rundll32.exe	28
PID 1796 wrote to memory of 1720	1796	rundll32.exe	28
PID 1796 wrote to memory of 1720	1796	rundll32.exe	28
PID 1796 wrote to memory of 1720	1796	rundll32.exe	28
PID 1796 wrote to memory of 1720	1796	rundll32.exe	28
PID 1796 wrote to memory of 1720	1796	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_476cc2523f5745af2f5ab4de4fe8a96a106af2a796c222c572ede39bafd39fff_2022-01-04__042339.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_476cc2523f5745af2f5ab4de4fe8a96a106af2a796c222c572ede39bafd39fff_2022-01-04__042339.exe.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_476cc2523f5745af2f5ab4de4fe8a96a106af2a796c222c572ede39bafd39fff_2022-01-04__042339.exe.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:1720

memory/1796-56-0x0000000075831000-0x0000000075833000-memory.dmp

Download

memory/1796-59-0x0000000010000000-0x0000000010028000-memory.dmp

Download