emotet | cc9fc83e64d50a4b86fdf93d608c27c5cc5b568817cec9bb98c13ccb0fbbebea

Analysis

Target
emotet_exe_e3_cc9fc83e64d50a4b86fdf93d608c27c5cc5b568817cec9bb98c13ccb0fbbebea_2020-12-22__180510.exe.dll
Size 270KB
Sample201222-ychcxt7ex2
SHA256 cc9fc83e64d50a4b86fdf93d608c27c5cc5b568817cec9bb98c13ccb0fbbebea
MD5 4a06315277fdd3b77548dbc7369cc2d9
SHA1 7e781b7294b10120743604f29351a7d78d646b90
SHA512 9bf2f37a5bfa26c8f9bd01e95d36098a8a9469f254b069a13f7b351ede8ecc554566ab995d722a94da350fee44d862ff057f8d19e351cdc52b08b1c3204280dd
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rsa_pubkey.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 4 IoCs

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4800	4768	rundll32.exe	69
PID 4768 wrote to memory of 4800	4768	rundll32.exe	69
PID 4768 wrote to memory of 4800	4768	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_cc9fc83e64d50a4b86fdf93d608c27c5cc5b568817cec9bb98c13ccb0fbbebea_2020-12-22__180510.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_cc9fc83e64d50a4b86fdf93d608c27c5cc5b568817cec9bb98c13ccb0fbbebea_2020-12-22__180510.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:4800

memory/4800-3-0x00000000032F0000-0x0000000003310000-memory.dmp

Download