e24c3f5539484830fa7fe0615578d543a2e90715fbf04390bfddbbfd62e4c450 | Triage

Analysis

max time kernel
21s
max time network
139s
platform
windows7_x64
resource
win7v20201028
submitted
14-01-2021 00:02

Sharing

Report Analysis Logs

General

Target

emotet_exe_e1_e24c3f5539484830fa7fe0615578d543a2e90715fbf04390bfddbbfd62e4c450_2021-01-14__000144.exe.dll
Size

271KB
MD5

bae07e12cb838c3d2d73c05d22c8c386
SHA1

e8d71cc422b53edbf46d08e80e85e5ace9992523
SHA256

e24c3f5539484830fa7fe0615578d543a2e90715fbf04390bfddbbfd62e4c450
SHA512

93d34a4486f7bf4e1feab192b004301fb623bc12e25804ae579ee5440299bdd43f2b3a3cb476333a1ec27ff395675040456e83fce55d898ca360a26714e3b37b

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

5 1944 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1944 rundll32.exe
1944 rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 596 wrote to memory of 1944	596	rundll32.exe	rundll32.exe
PID 596 wrote to memory of 1944	596	rundll32.exe	rundll32.exe
PID 596 wrote to memory of 1944	596	rundll32.exe	rundll32.exe
PID 596 wrote to memory of 1944	596	rundll32.exe	rundll32.exe
PID 596 wrote to memory of 1944	596	rundll32.exe	rundll32.exe
PID 596 wrote to memory of 1944	596	rundll32.exe	rundll32.exe
PID 596 wrote to memory of 1944	596	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_e24c3f5539484830fa7fe0615578d543a2e90715fbf04390bfddbbfd62e4c450_2021-01-14__000144.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:596

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_e24c3f5539484830fa7fe0615578d543a2e90715fbf04390bfddbbfd62e4c450_2021-01-14__000144.exe.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/896-3-0x000007FEF72E0000-0x000007FEF755A000-memory.dmp

Filesize
2.5MB

Download
memory/1944-2-0x0000000000000000-mapping.dmp

Download