emotet | ef15b89c6dac1e9744e5c1e8febfa9019242dba9cdc69f428fad320f628849ad

Analysis

Target
emotet_exe_e3_ef15b89c6dac1e9744e5c1e8febfa9019242dba9cdc69f428fad320f628849ad_2020-12-22__000034.exe.dll
Size 227KB
Sample201222-fkbtc9pg16
SHA256 ef15b89c6dac1e9744e5c1e8febfa9019242dba9cdc69f428fad320f628849ad
MD5 a31a34735812c0b271610f1dfa6d2a88
SHA1 26237678c08e76ec103465514996142e6085430d
SHA512 9f17b89cde8922a8c1228aaac81a60b123d40f3611c61bdc7c04b26f9fdc482382bb26c1418ac446afd03f2019212206fcd91ab7b6fca0ef142367dc4f7b71cc
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rsa_pubkey.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 4 IoCs

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4836	4764	rundll32.exe	68
PID 4764 wrote to memory of 4836	4764	rundll32.exe	68
PID 4764 wrote to memory of 4836	4764	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_ef15b89c6dac1e9744e5c1e8febfa9019242dba9cdc69f428fad320f628849ad_2020-12-22__000034.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_ef15b89c6dac1e9744e5c1e8febfa9019242dba9cdc69f428fad320f628849ad_2020-12-22__000034.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:4836

memory/4836-3-0x0000000004A00000-0x0000000004A20000-memory.dmp

Download