emotet | 71ade25bf79d920cc2ab52c3bfdd0299d9958af1633a2336fe5dce4337eb8ab1

General

Target
emotet_exe_e3_71ade25bf79d920cc2ab52c3bfdd0299d9958af1633a2336fe5dce4337eb8ab1_2020-12-22__211851.exe.dll
Size 271KB
Sample201222-3b17166e22
SHA256 71ade25bf79d920cc2ab52c3bfdd0299d9958af1633a2336fe5dce4337eb8ab1
MD5 008ed4188d45ee352d8ec2b42bcf0226
SHA1 2f64d2f7a3caad419545d1b5ed4b1edcab752dac
SHA512 ba9509e6b9a7eac1726968b141585d2759dcd374e041db9eecfdad6d05dc3d168c0e5d0cdd972912f5bc80f286ed2449f58ea7b284b9d409c41f1a1a9b7a9790
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

C2

rsa_pubkey.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 6 IoCs

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 1028	1008	rundll32.exe	25
PID 1008 wrote to memory of 1028	1008	rundll32.exe	25
PID 1008 wrote to memory of 1028	1008	rundll32.exe	25
PID 1008 wrote to memory of 1028	1008	rundll32.exe	25
PID 1008 wrote to memory of 1028	1008	rundll32.exe	25
PID 1008 wrote to memory of 1028	1008	rundll32.exe	25
PID 1008 wrote to memory of 1028	1008	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_71ade25bf79d920cc2ab52c3bfdd0299d9958af1633a2336fe5dce4337eb8ab1_2020-12-22__211851.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_71ade25bf79d920cc2ab52c3bfdd0299d9958af1633a2336fe5dce4337eb8ab1_2020-12-22__211851.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1028

memory/1028-3-0x00000000001F0000-0x0000000000210000-memory.dmp

Download

memory/1264-4-0x000007FEF8800000-0x000007FEF8A7A000-memory.dmp

Download