e24c3f5539484830fa7fe0615578d543a2e90715fbf04390bfddbbfd62e4c450 | Triage

Analysis

max time kernel
89s
max time network
130s
platform
windows10_x64
resource
win10v20201028
submitted
14-01-2021 00:02

Sharing

Report Analysis Logs

General

Target

emotet_exe_e1_e24c3f5539484830fa7fe0615578d543a2e90715fbf04390bfddbbfd62e4c450_2021-01-14__000144.exe.dll
Size

271KB
MD5

bae07e12cb838c3d2d73c05d22c8c386
SHA1

e8d71cc422b53edbf46d08e80e85e5ace9992523
SHA256

e24c3f5539484830fa7fe0615578d543a2e90715fbf04390bfddbbfd62e4c450
SHA512

93d34a4486f7bf4e1feab192b004301fb623bc12e25804ae579ee5440299bdd43f2b3a3cb476333a1ec27ff395675040456e83fce55d898ca360a26714e3b37b

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

14 2728 rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

2728 rundll32.exe
2728 rundll32.exe
2728 rundll32.exe
2728 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1404 wrote to memory of 2728	1404	rundll32.exe	rundll32.exe
PID 1404 wrote to memory of 2728	1404	rundll32.exe	rundll32.exe
PID 1404 wrote to memory of 2728	1404	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_e24c3f5539484830fa7fe0615578d543a2e90715fbf04390bfddbbfd62e4c450_2021-01-14__000144.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_e24c3f5539484830fa7fe0615578d543a2e90715fbf04390bfddbbfd62e4c450_2021-01-14__000144.exe.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:2728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2728-2-0x0000000000000000-mapping.dmp

Download