emotet | 00a3361ae11ad7f9e1a8a0e7197528a07f5b609cfe59beb0ee3c22f9cec03511

Analysis

Target
emotet_exe_e3_00a3361ae11ad7f9e1a8a0e7197528a07f5b609cfe59beb0ee3c22f9cec03511_2020-12-21__100525.exe.dll
Size 220KB
Sample201221-gtmb8p824a
SHA256 00a3361ae11ad7f9e1a8a0e7197528a07f5b609cfe59beb0ee3c22f9cec03511
MD5 3f227504d9b614cff9baa4e5cca44e4d
SHA1 bec3c79a7dbbd89f1e133a88593664965d768661
SHA512 f5836c961f5be419aa909c604062ca1e2845ab905fc392383908d16cc2fd91806bb4e84c517446db260d1c8fddbe166bd677b67522dfdfd796f0d193ae5aa490
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rsa_pubkey.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 1 IoCs

flow	pid	Process
14	4768	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4768	4648	rundll32.exe	70
PID 4648 wrote to memory of 4768	4648	rundll32.exe	70
PID 4648 wrote to memory of 4768	4648	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_00a3361ae11ad7f9e1a8a0e7197528a07f5b609cfe59beb0ee3c22f9cec03511_2020-12-21__100525.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_00a3361ae11ad7f9e1a8a0e7197528a07f5b609cfe59beb0ee3c22f9cec03511_2020-12-21__100525.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:4768

memory/4768-3-0x0000000003090000-0x00000000030B0000-memory.dmp

Download