emotet | a196d190c19baa006dbd5fe43cb2a467b119aa976f886643a21405719eff61ca

Analysis

Target
emotet_exe_e3_a196d190c19baa006dbd5fe43cb2a467b119aa976f886643a21405719eff61ca_2020-12-21__141234.exe.dll
Size 220KB
Sample201221-rczjjpf4ce
SHA256 a196d190c19baa006dbd5fe43cb2a467b119aa976f886643a21405719eff61ca
MD5 f2ba11307f103cbeeb1e2b23a6245ab8
SHA1 93a2564b0a8ea389fb6f2a2acf2fb01d703b0d55
SHA512 0761a0d076a1db2a637fdef21e34cbe72a6c7c1c786368eb988ef529314008d45ffd802f6d5f14a9e9b76876649f50b28fb3c9e06c2e05d3b17d4d3e83029546
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rsa_pubkey.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 1 IoCs

flow	pid	Process
10	1364	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 1364	1144	rundll32.exe	60
PID 1144 wrote to memory of 1364	1144	rundll32.exe	60
PID 1144 wrote to memory of 1364	1144	rundll32.exe	60

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_a196d190c19baa006dbd5fe43cb2a467b119aa976f886643a21405719eff61ca_2020-12-21__141234.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_a196d190c19baa006dbd5fe43cb2a467b119aa976f886643a21405719eff61ca_2020-12-21__141234.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1364

memory/1364-3-0x0000000002D60000-0x0000000002D80000-memory.dmp

Download