emotet | 8d3113a021d813389f73c4161d00eda8f4b11ff11b4dd175bf3c76b08ce83b41

Analysis

Target
emotet_exe_e4_476cc2523f5745af2f5ab4de4fe8a96a106af2a796c222c572ede39bafd39fff_2022-01-04__042339.exe.dll
Size 527KB
Sample220104-e1d4dafga3
SHA256 8d3113a021d813389f73c4161d00eda8f4b11ff11b4dd175bf3c76b08ce83b41
MD5 c1bb8bde4df7bf942a93657c091a0454
SHA1 cdcdb3cd01cde8b1b1316638cecbb6d8406fb7ac
SHA512 f7a4e55038c06b9d68207a729383d2b829e18909058a68e8d47085d9667a195d9db8cf38a49bfaa9861276149366fc8e958182e53b0730cdcfe10c7ed173915d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 6 IoCs

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3920	rundll32.exe
3920	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2664	2676	rundll32.exe	68
PID 2676 wrote to memory of 2664	2676	rundll32.exe	68
PID 2676 wrote to memory of 2664	2676	rundll32.exe	68
PID 2664 wrote to memory of 3920	2664	rundll32.exe	69
PID 2664 wrote to memory of 3920	2664	rundll32.exe	69
PID 2664 wrote to memory of 3920	2664	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_476cc2523f5745af2f5ab4de4fe8a96a106af2a796c222c572ede39bafd39fff_2022-01-04__042339.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_476cc2523f5745af2f5ab4de4fe8a96a106af2a796c222c572ede39bafd39fff_2022-01-04__042339.exe.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_476cc2523f5745af2f5ab4de4fe8a96a106af2a796c222c572ede39bafd39fff_2022-01-04__042339.exe.dll",Control_RunDLL
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3920

memory/2664-116-0x0000000010000000-0x0000000010028000-memory.dmp

Download