abbca19344bd039c31963fb2c2239a104e36c46c27f44400648675d3d2e86a80 | Triage

Analysis

max time kernel
45s
max time network
130s
platform
windows10_x64
resource
win10v20201028
submitted
14-01-2021 00:07

Sharing

Report Analysis Logs

General

Target

emotet_exe_e2_abbca19344bd039c31963fb2c2239a104e36c46c27f44400648675d3d2e86a80_2021-01-14__000605.exe.dll
Size

273KB
MD5

97b152267583735d0687771a3be34929
SHA1

9f489dba0362598aa1ceb4efafd8bf8b88d37e0b
SHA256

abbca19344bd039c31963fb2c2239a104e36c46c27f44400648675d3d2e86a80
SHA512

ed2d1654c0356eab2eec95c2ccc50bec378603b12ad1e1b221e97d7a7ba38678e32e14e25b78f426fa3fa06df7b8883877b881a7b8214baeb5224d0257faaf87

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

18 4000 rundll32.exe
19 4000 rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

4000 rundll32.exe
4000 rundll32.exe
4000 rundll32.exe
4000 rundll32.exe
4000 rundll32.exe
4000 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4048 wrote to memory of 4000	4048	rundll32.exe	rundll32.exe
PID 4048 wrote to memory of 4000	4048	rundll32.exe	rundll32.exe
PID 4048 wrote to memory of 4000	4048	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_abbca19344bd039c31963fb2c2239a104e36c46c27f44400648675d3d2e86a80_2021-01-14__000605.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4048

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_abbca19344bd039c31963fb2c2239a104e36c46c27f44400648675d3d2e86a80_2021-01-14__000605.exe.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4000-2-0x0000000000000000-mapping.dmp

Download