emotet | d1204f24ea69df322494d6f3b84d8c23fc62c69a822fa0b8db48898c337cef89

Analysis

Target
emotet_exe_e3_d1204f24ea69df322494d6f3b84d8c23fc62c69a822fa0b8db48898c337cef89_2020-12-21__100525.exe.dll
Size 220KB
Sample201221-ekjdbfhhbj
SHA256 d1204f24ea69df322494d6f3b84d8c23fc62c69a822fa0b8db48898c337cef89
MD5 1e5d561d906f8e9cde2bebf3c9c751cc
SHA1 9517afd91b1b855ed218d4c0cdbd678849a030ce
SHA512 1bfcede4d32ff5e5532c9b3c1966dc95e78d65f163653db541e3870055d7c25c708c19695346a53325422b084caab5c9cc3a23682fdb379cf18ba9e664ff9a02
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rsa_pubkey.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 1 IoCs

flow	pid	Process
13	3916	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 3916	728	rundll32.exe	69
PID 728 wrote to memory of 3916	728	rundll32.exe	69
PID 728 wrote to memory of 3916	728	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_d1204f24ea69df322494d6f3b84d8c23fc62c69a822fa0b8db48898c337cef89_2020-12-21__100525.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_d1204f24ea69df322494d6f3b84d8c23fc62c69a822fa0b8db48898c337cef89_2020-12-21__100525.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3916

memory/3916-3-0x0000000000720000-0x0000000000740000-memory.dmp

Download