emotet | 2c67ba7b9a99491ce7b95f347e20d9011f627a439be7ed729f89f8a87bd03b72

Analysis

Target
emotet_exe_e3_2c67ba7b9a99491ce7b95f347e20d9011f627a439be7ed729f89f8a87bd03b72_2020-12-21__130205.exe.dll
Size 220KB
Sample201221-akk9v7cha2
SHA256 2c67ba7b9a99491ce7b95f347e20d9011f627a439be7ed729f89f8a87bd03b72
MD5 51b297e128278314dc2451944d14dec7
SHA1 9b03da2d98835a6150c1ed17df63e721114812df
SHA512 bd4d5863b0dfae005fd845ccf971c93f380531f5dbd7fa581f9527c903a720a788632bc3e0844c67ad4fa914b483479eb6064241bd478691da0178d8cecabe65
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rsa_pubkey.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 1 IoCs

flow	pid	Process
17	4696	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 4696	4680	rundll32.exe	51
PID 4680 wrote to memory of 4696	4680	rundll32.exe	51
PID 4680 wrote to memory of 4696	4680	rundll32.exe	51

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_2c67ba7b9a99491ce7b95f347e20d9011f627a439be7ed729f89f8a87bd03b72_2020-12-21__130205.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_2c67ba7b9a99491ce7b95f347e20d9011f627a439be7ed729f89f8a87bd03b72_2020-12-21__130205.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:4696

memory/4696-3-0x0000000002AC0000-0x0000000002AE0000-memory.dmp

Download