emotet | c5223396ec7dc752ee4dcc5c1b31bd28ac8cef3e2fa71f9bdbe2601f41d868d8

Analysis

Target
emotet_exe_e3_c5223396ec7dc752ee4dcc5c1b31bd28ac8cef3e2fa71f9bdbe2601f41d868d8_2020-12-22__000033.exe.dll
Size 227KB
Sample201222-xjpdtvf7le
SHA256 c5223396ec7dc752ee4dcc5c1b31bd28ac8cef3e2fa71f9bdbe2601f41d868d8
MD5 ca97e0f868f3544248482f31eeac7959
SHA1 c9107d9d827edb5c74d8c70ed02a537e631787f5
SHA512 43f7cd1e59704072ce5429be1fb9fdf577aacbb22f9c7213492ec1b02962ba51e232fb6e60ea2441ac441e9da1ada1b23a314e40ff8f9406bb4d5ef1a6c668d9
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rsa_pubkey.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 4 IoCs

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 3628	3888	rundll32.exe	40
PID 3888 wrote to memory of 3628	3888	rundll32.exe	40
PID 3888 wrote to memory of 3628	3888	rundll32.exe	40

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_c5223396ec7dc752ee4dcc5c1b31bd28ac8cef3e2fa71f9bdbe2601f41d868d8_2020-12-22__000033.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_c5223396ec7dc752ee4dcc5c1b31bd28ac8cef3e2fa71f9bdbe2601f41d868d8_2020-12-22__000033.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3628

memory/3628-3-0x0000000004BA0000-0x0000000004BC0000-memory.dmp

Download