emotet | d2487ebc7e7702f48d99fda9d8afaba3f7e0b64ecdc0f25f6893af5b30d370e9

General

Target
emotet_exe_e3_d2487ebc7e7702f48d99fda9d8afaba3f7e0b64ecdc0f25f6893af5b30d370e9_2020-12-22__000034.exe.dll
Size 227KB
Sample201222-bxts65pr32
SHA256 d2487ebc7e7702f48d99fda9d8afaba3f7e0b64ecdc0f25f6893af5b30d370e9
MD5 8a39f6fafa38b0ead934a5d63ff0a662
SHA1 b23a08ab247e87a32c16bd1fd349ba9684dbb0dd
SHA512 248a04a1d5082a00dd878168ccd05f6f57402ed5ee1d1ac72b09312d02c1dc53387d88305507bfc9259f186dba1eadf75c818f46ac626e15942f33c96353720f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

C2

rsa_pubkey.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 7 IoCs

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2040	1648	rundll32.exe	26
PID 1648 wrote to memory of 2040	1648	rundll32.exe	26
PID 1648 wrote to memory of 2040	1648	rundll32.exe	26
PID 1648 wrote to memory of 2040	1648	rundll32.exe	26
PID 1648 wrote to memory of 2040	1648	rundll32.exe	26
PID 1648 wrote to memory of 2040	1648	rundll32.exe	26
PID 1648 wrote to memory of 2040	1648	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_d2487ebc7e7702f48d99fda9d8afaba3f7e0b64ecdc0f25f6893af5b30d370e9_2020-12-22__000034.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_d2487ebc7e7702f48d99fda9d8afaba3f7e0b64ecdc0f25f6893af5b30d370e9_2020-12-22__000034.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:2040

memory/1372-4-0x000007FEF6F80000-0x000007FEF71FA000-memory.dmp

Download

memory/2040-3-0x00000000001B0000-0x00000000001D0000-memory.dmp

Download