emotet | 3af8de8ad638629a95f75d7c1ca23ebe090eaf8f9df0dcd895a683bcf0fe236e

Analysis

Target
emotet_exe_e3_3af8de8ad638629a95f75d7c1ca23ebe090eaf8f9df0dcd895a683bcf0fe236e_2020-12-22__064020.exe.dll
Size 327KB
Sample201222-kraz1pqlqs
SHA256 3af8de8ad638629a95f75d7c1ca23ebe090eaf8f9df0dcd895a683bcf0fe236e
MD5 c6dfda2fc4949d0dab3c7f19f95fbf7d
SHA1 687f618418b02ff1d433cfdb2418f01830fca008
SHA512 5857b2df717b1babdd542f23ba0e32f8246de8192f58897d338d83f98757e0f5deb9d76d1842a25015314340619223fb221bb718430c1fd34560ae67ba971c47
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rsa_pubkey.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 1 IoCs

flow	pid	Process
16	4756	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 4756	4636	rundll32.exe	71
PID 4636 wrote to memory of 4756	4636	rundll32.exe	71
PID 4636 wrote to memory of 4756	4636	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_3af8de8ad638629a95f75d7c1ca23ebe090eaf8f9df0dcd895a683bcf0fe236e_2020-12-22__064020.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_3af8de8ad638629a95f75d7c1ca23ebe090eaf8f9df0dcd895a683bcf0fe236e_2020-12-22__064020.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:4756

memory/4756-3-0x0000000003120000-0x0000000003140000-memory.dmp

Download