2123b6fe4cba8ee254a8cc742b91e6189378eab77a3157a484c41746e6181abd | Triage

Analysis

max time kernel
27s
max time network
137s
platform
windows10_x64
resource
win10v20201028
submitted
14-01-2021 00:02

Sharing

Report Analysis Logs

General

Target

emotet_exe_e1_2123b6fe4cba8ee254a8cc742b91e6189378eab77a3157a484c41746e6181abd_2021-01-14__000141.exe.dll
Size

271KB
MD5

95d38c808d9999d48ae03c60d1ae9a38
SHA1

ba073612e60059a77ea269b0911a5dbe253fa83e
SHA256

2123b6fe4cba8ee254a8cc742b91e6189378eab77a3157a484c41746e6181abd
SHA512

b9a3cc55fc0f456e2ad0a120e3901baad97f99e80848e1c54aae55945f8f5351b58ff2bd83a77e0827450fc432cbbefe15644ce737954225c6ae03ae373b507a

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

24 1484 rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

1484 rundll32.exe
1484 rundll32.exe
1484 rundll32.exe
1484 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 412 wrote to memory of 1484	412	rundll32.exe	rundll32.exe
PID 412 wrote to memory of 1484	412	rundll32.exe	rundll32.exe
PID 412 wrote to memory of 1484	412	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_2123b6fe4cba8ee254a8cc742b91e6189378eab77a3157a484c41746e6181abd_2021-01-14__000141.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:412

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_2123b6fe4cba8ee254a8cc742b91e6189378eab77a3157a484c41746e6181abd_2021-01-14__000141.exe.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1484-2-0x0000000000000000-mapping.dmp

Download