emotet | 0901b8df4c61822a703c384904e6d910dc5e500fab3d75fa2d5bc2e2cc3122d0

Analysis

Target
emotet_exe_e3_0901b8df4c61822a703c384904e6d910dc5e500fab3d75fa2d5bc2e2cc3122d0_2020-12-23__000408.exe.dll
Size 271KB
Sample201223-4hxdd3spae
SHA256 0901b8df4c61822a703c384904e6d910dc5e500fab3d75fa2d5bc2e2cc3122d0
MD5 416af11e6629e1ce74a0f511e034a786
SHA1 3e852c4900e407cd4ced82f5b1d5b63e7b1eeae3
SHA512 fea686f9c0a08730b60223e537b9f47d7462862b76012d5b5daaf1782449a04238f60b199aa3f72a3192064eda69ef4bf5a12c98b4369d36ec10bf8c2c8c9887
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rsa_pubkey.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 4 IoCs

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4844	4764	rundll32.exe	62
PID 4764 wrote to memory of 4844	4764	rundll32.exe	62
PID 4764 wrote to memory of 4844	4764	rundll32.exe	62

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_0901b8df4c61822a703c384904e6d910dc5e500fab3d75fa2d5bc2e2cc3122d0_2020-12-23__000408.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_0901b8df4c61822a703c384904e6d910dc5e500fab3d75fa2d5bc2e2cc3122d0_2020-12-23__000408.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:4844

memory/4844-3-0x0000000000600000-0x0000000000620000-memory.dmp

Download