emotet | aab6792121b1e5be4598a1b2cb8cd80608d6f4345ef3ba4f13120a3a1f17b549

General

Target
emotet_exe_e3_aab6792121b1e5be4598a1b2cb8cd80608d6f4345ef3ba4f13120a3a1f17b549_2020-12-22__000032.exe.dll
Size 227KB
Sample201222-2k3blv3kae
SHA256 aab6792121b1e5be4598a1b2cb8cd80608d6f4345ef3ba4f13120a3a1f17b549
MD5 5937c3f9fb3c180668ef590e54ea970e
SHA1 23f45deab3e6144f0a98bfe834426f3efb5d4b0c
SHA512 5662885c1a54474d2620c833147c17b2206b0254b679031c54790ab2ccebab2bcb39301f8e5efc8b86d7ddb978333bc8e1f2482c2bc508c9ce7e6447315a87f0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

C2

rsa_pubkey.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 7 IoCs

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1524	1824	rundll32.exe	26
PID 1824 wrote to memory of 1524	1824	rundll32.exe	26
PID 1824 wrote to memory of 1524	1824	rundll32.exe	26
PID 1824 wrote to memory of 1524	1824	rundll32.exe	26
PID 1824 wrote to memory of 1524	1824	rundll32.exe	26
PID 1824 wrote to memory of 1524	1824	rundll32.exe	26
PID 1824 wrote to memory of 1524	1824	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_aab6792121b1e5be4598a1b2cb8cd80608d6f4345ef3ba4f13120a3a1f17b549_2020-12-22__000032.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_aab6792121b1e5be4598a1b2cb8cd80608d6f4345ef3ba4f13120a3a1f17b549_2020-12-22__000032.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1524

memory/1524-3-0x00000000001E0000-0x0000000000200000-memory.dmp

Download

memory/1780-4-0x000007FEF7FE0000-0x000007FEF825A000-memory.dmp

Download