emotet | 0ca16d12531af9302dcc3dbdbdbf43bcee9511f75ee1a8375f475af92d4ad5bf

General

Target
emotet_exe_e3_0ca16d12531af9302dcc3dbdbdbf43bcee9511f75ee1a8375f475af92d4ad5bf_2020-12-23__000408.exe.dll
Size 271KB
Sample201223-akwcdar99j
SHA256 0ca16d12531af9302dcc3dbdbdbf43bcee9511f75ee1a8375f475af92d4ad5bf
MD5 20d029736ccb4b9c3011bb64ee361f23
SHA1 10a0a69df82dc3bcc1194b5e095f3ff5af9ea717
SHA512 1ebf91b32db86eefb7d98fb2a8be8e0d429115ff8415a9738cb736758e8d111a62964ef187aff6d1f97bc0083cfdc14fbed73dabfc960ad2b71cdd22c73a0a3a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

C2

rsa_pubkey.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 6 IoCs

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1996	1824	rundll32.exe	26
PID 1824 wrote to memory of 1996	1824	rundll32.exe	26
PID 1824 wrote to memory of 1996	1824	rundll32.exe	26
PID 1824 wrote to memory of 1996	1824	rundll32.exe	26
PID 1824 wrote to memory of 1996	1824	rundll32.exe	26
PID 1824 wrote to memory of 1996	1824	rundll32.exe	26
PID 1824 wrote to memory of 1996	1824	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_0ca16d12531af9302dcc3dbdbdbf43bcee9511f75ee1a8375f475af92d4ad5bf_2020-12-23__000408.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_0ca16d12531af9302dcc3dbdbdbf43bcee9511f75ee1a8375f475af92d4ad5bf_2020-12-23__000408.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1996

memory/1536-4-0x000007FEF5D50000-0x000007FEF5FCA000-memory.dmp

Download

memory/1996-3-0x00000000001F0000-0x0000000000210000-memory.dmp

Download