emotet | 6ad2a681daef6cb3561d434afa8ee6d96dffa1af2fd5d4e1b9d6f0474d346a48

Analysis

Target
emotet_exe_e3_6ad2a681daef6cb3561d434afa8ee6d96dffa1af2fd5d4e1b9d6f0474d346a48_2020-12-22__000032.exe.dll
Size 227KB
Sample201222-1pgjpkm53s
SHA256 6ad2a681daef6cb3561d434afa8ee6d96dffa1af2fd5d4e1b9d6f0474d346a48
MD5 95a284bac7c6b5d2d691d11bccb87908
SHA1 8f6593224e354d790dcbcfec1e1fac8331706f53
SHA512 74a81390675d8b1063d060064d93f4655d764e23d859bb323f265cc580233bdf3cf466957372c3941dbcb85da8ac29c5ae4c2ae63cff8f7b72a7330dadd36509
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rsa_pubkey.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 4 IoCs

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 1844	1316	rundll32.exe	70
PID 1316 wrote to memory of 1844	1316	rundll32.exe	70
PID 1316 wrote to memory of 1844	1316	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_6ad2a681daef6cb3561d434afa8ee6d96dffa1af2fd5d4e1b9d6f0474d346a48_2020-12-22__000032.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_6ad2a681daef6cb3561d434afa8ee6d96dffa1af2fd5d4e1b9d6f0474d346a48_2020-12-22__000032.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1844

memory/1844-3-0x0000000001010000-0x0000000001030000-memory.dmp

Download