emotet | 5aab786979bc9b095b39d9339376acb21f1c905dc6b7bfaabd71da2f6f4216fa

Analysis

Target
emotet_exe_e3_5aab786979bc9b095b39d9339376acb21f1c905dc6b7bfaabd71da2f6f4216fa_2020-12-21__100525.exe.dll
Size 220KB
Sample201221-m8bj556dss
SHA256 5aab786979bc9b095b39d9339376acb21f1c905dc6b7bfaabd71da2f6f4216fa
MD5 8e07d2a8a67addd6de906a6f11367757
SHA1 ee595a20cb7181ac5d1709f8a7dff06049c0fd91
SHA512 dcab2e3b3a917ae69b746158fd67700cec295ce8f3172774e64c4352b9b2f13e22eec0e46ecf8a1145ad74dcba178444c40299c85af297aeb33d79e81df18ec7
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rsa_pubkey.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 1 IoCs

flow	pid	Process
15	424	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 424	576	rundll32.exe	70
PID 576 wrote to memory of 424	576	rundll32.exe	70
PID 576 wrote to memory of 424	576	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_5aab786979bc9b095b39d9339376acb21f1c905dc6b7bfaabd71da2f6f4216fa_2020-12-21__100525.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_5aab786979bc9b095b39d9339376acb21f1c905dc6b7bfaabd71da2f6f4216fa_2020-12-21__100525.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:424

memory/424-3-0x00000000032B0000-0x00000000032D0000-memory.dmp

Download