8943f490a334356cb24f24d1787e07f5c4e0ebf512052a9214d63f632eab62e9 | Triage

Analysis

max time kernel
51s
max time network
53s
platform
windows10_x64
resource
win10v20201028
submitted
14-01-2021 00:01

Sharing

Report Analysis Logs

General

Target

emotet_exe_e1_8943f490a334356cb24f24d1787e07f5c4e0ebf512052a9214d63f632eab62e9_2021-01-14__000141._exe.dll
Size

271KB
MD5

011a5c42b36962a5ccf33a00754834cb
SHA1

8b264e99ce11728cf579d35a92bd4443cbb37aed
SHA256

8943f490a334356cb24f24d1787e07f5c4e0ebf512052a9214d63f632eab62e9
SHA512

97d37e22a8f631a682869bb69420c7565b71c80b4c7e08c7beac89d207feed7b948ed5051f6c6568e1db926adc57dbebd6f05252fa267f586de0ad0ea8603ca1

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

13 4796 rundll32.exe
18 4796 rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

4796 rundll32.exe
4796 rundll32.exe
4796 rundll32.exe
4796 rundll32.exe
4796 rundll32.exe
4796 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4688 wrote to memory of 4796	4688	rundll32.exe	rundll32.exe
PID 4688 wrote to memory of 4796	4688	rundll32.exe	rundll32.exe
PID 4688 wrote to memory of 4796	4688	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_8943f490a334356cb24f24d1787e07f5c4e0ebf512052a9214d63f632eab62e9_2021-01-14__000141._exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4688

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_8943f490a334356cb24f24d1787e07f5c4e0ebf512052a9214d63f632eab62e9_2021-01-14__000141._exe.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4796-2-0x0000000000000000-mapping.dmp

Download