emotet | 32e9d045db5e65f640a2b2e9b8dcf6424269b233dda2bc4fbdc5a991ae79495b

Analysis

Target
emotet_exe_e3_32e9d045db5e65f640a2b2e9b8dcf6424269b233dda2bc4fbdc5a991ae79495b_2020-12-23__000408.exe.dll
Size 271KB
Sample201223-yy5aydlbdj
SHA256 32e9d045db5e65f640a2b2e9b8dcf6424269b233dda2bc4fbdc5a991ae79495b
MD5 68789e81f7e6d0f1b69a7c3687c047c1
SHA1 1199a8365a7760aeece92f3ac3fb4cf242619ee6
SHA512 feeb2b5eaf96ec8be89b6202db72bff171b0fd11f3d6febc81facf44f2be530d3429bc3ec670eaf145247e905302eb2fb806c4fdc6f32ba827b2249d7573f425
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rsa_pubkey.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 4 IoCs

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 1184	1176	rundll32.exe	69
PID 1176 wrote to memory of 1184	1176	rundll32.exe	69
PID 1176 wrote to memory of 1184	1176	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_32e9d045db5e65f640a2b2e9b8dcf6424269b233dda2bc4fbdc5a991ae79495b_2020-12-23__000408.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_32e9d045db5e65f640a2b2e9b8dcf6424269b233dda2bc4fbdc5a991ae79495b_2020-12-23__000408.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1184

memory/1184-3-0x0000000002970000-0x0000000002990000-memory.dmp

Download