e2481621ce7efec0179a45d8557c67edf6a064445119cbc16802f434166c5498 | Triage

Analysis

max time kernel
21s
max time network
143s
platform
windows7_x64
resource
win7v20201028
submitted
14-01-2021 00:02

Sharing

Report Analysis Logs

General

Target

emotet_exe_e1_e2481621ce7efec0179a45d8557c67edf6a064445119cbc16802f434166c5498_2021-01-14__000144.exe.dll
Size

271KB
MD5

fd43889418f21c59ca856d3a3742c9f6
SHA1

084fa4cc8747ec79f1aa005b11eaed52bc4c328e
SHA256

e2481621ce7efec0179a45d8557c67edf6a064445119cbc16802f434166c5498
SHA512

c7f1bb97cf20017abf4371b66215e88f61f28a425e75021e7d1d6e09d6cbe1345cf937e96e775246e056c506da48286a9d2c3e20d178d09ea23012106df1fe6a

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

5 2012 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2012 rundll32.exe
2012 rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1056 wrote to memory of 2012	1056	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 2012	1056	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 2012	1056	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 2012	1056	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 2012	1056	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 2012	1056	rundll32.exe	rundll32.exe
PID 1056 wrote to memory of 2012	1056	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_e2481621ce7efec0179a45d8557c67edf6a064445119cbc16802f434166c5498_2021-01-14__000144.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1056

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_e2481621ce7efec0179a45d8557c67edf6a064445119cbc16802f434166c5498_2021-01-14__000144.exe.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-3-0x000007FEF71F0000-0x000007FEF746A000-memory.dmp

Filesize
2.5MB

Download
memory/2012-2-0x0000000000000000-mapping.dmp

Download