emotet | 42f7cd041328711fa533bfa7f26be5c867d4eaa2f4ac3fa7bb94fe78ece38a92

Analysis

Target
emotet_exe_e3_42f7cd041328711fa533bfa7f26be5c867d4eaa2f4ac3fa7bb94fe78ece38a92_2020-12-22__000033.exe.dll
Size 227KB
Sample201222-wjemca3gmj
SHA256 42f7cd041328711fa533bfa7f26be5c867d4eaa2f4ac3fa7bb94fe78ece38a92
MD5 9ae4ea1389707298a3040d2c5829dca3
SHA1 54fa6365eabda9939018eaccafe7dfa401a1e43b
SHA512 10b299d0ed23824c9be8bb33ea203353a7681737cdad889fcf81a49a28b5af23ca39f62eece4d7e9ed5833575c65542e831e0df502be0d9616d7b1a8fa0f8539
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rsa_pubkey.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 4 IoCs

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 908	652	rundll32.exe	70
PID 652 wrote to memory of 908	652	rundll32.exe	70
PID 652 wrote to memory of 908	652	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_42f7cd041328711fa533bfa7f26be5c867d4eaa2f4ac3fa7bb94fe78ece38a92_2020-12-22__000033.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_42f7cd041328711fa533bfa7f26be5c867d4eaa2f4ac3fa7bb94fe78ece38a92_2020-12-22__000033.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:908

memory/908-3-0x0000000002BE0000-0x0000000002C00000-memory.dmp

Download