c5e97cf63b4f5f443c475101a9331a130f4d479399a52cfac24d1bcfa9d78c15 | Triage

Analysis

max time kernel
115s
max time network
134s
platform
windows7_x64
resource
win7v20201028
submitted
13-01-2021 11:27

Sharing

Report Analysis Logs

General

Target

emotet_exe_e2_c5e97cf63b4f5f443c475101a9331a130f4d479399a52cfac24d1bcfa9d78c15_2021-01-13__112653.exe.dll
Size

273KB
MD5

3953df66655dcae10f47b4f5a62621fd
SHA1

68a6e31a2034c09d68e891079fd473bb30966c23
SHA256

c5e97cf63b4f5f443c475101a9331a130f4d479399a52cfac24d1bcfa9d78c15
SHA512

ad24c9fcc7f315a122cca8feb714976bbc881ecfb99eec99d20954bd26c94e66b7f899018a014e774aee73bdf78b8d091c1e3ec2f9876068f508ff01d25bab8a

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

6 1064 rundll32.exe
9 1064 rundll32.exe
10 1064 rundll32.exe
13 1064 rundll32.exe
14 1064 rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

1064 rundll32.exe
1064 rundll32.exe
1064 rundll32.exe
1064 rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1680 wrote to memory of 1064	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1064	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1064	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1064	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1064	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1064	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1064	1680	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_c5e97cf63b4f5f443c475101a9331a130f4d479399a52cfac24d1bcfa9d78c15_2021-01-13__112653.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_c5e97cf63b4f5f443c475101a9331a130f4d479399a52cfac24d1bcfa9d78c15_2021-01-13__112653.exe.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/272-3-0x000007FEF63A0000-0x000007FEF661A000-memory.dmp

Filesize
2.5MB

Download
memory/1064-2-0x0000000000000000-mapping.dmp

Download