3cb2dbaf32a6fa0039204c8edd52f63957d03e14136b98f246e9626af97a34a5 | Triage

Analysis

max time kernel
19s
max time network
134s
platform
windows7_x64
resource
win7v20201028
submitted
14-01-2021 00:02

Sharing

Report Analysis Logs

General

Target

emotet_exe_e3_3cb2dbaf32a6fa0039204c8edd52f63957d03e14136b98f246e9626af97a34a5_2021-01-14__000230._exe.dll
Size

278KB
MD5

a923150848ae6d9432b4684e2af35f27
SHA1

edc9240836d2c421423842c2e839abc6f461b0bd
SHA256

3cb2dbaf32a6fa0039204c8edd52f63957d03e14136b98f246e9626af97a34a5
SHA512

2077341361b2df1bc55323d9e9bc02e0a14dd82489e78ba596fd29f772cfd3579e21be5fb3bb4de03fc182c7bd37af294cc0f8938e5bbb75e9c699fd02177a47

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

5 2036 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2036 rundll32.exe
2036 rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1632 wrote to memory of 2036	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 2036	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 2036	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 2036	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 2036	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 2036	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 2036	1632	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_3cb2dbaf32a6fa0039204c8edd52f63957d03e14136b98f246e9626af97a34a5_2021-01-14__000230._exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_3cb2dbaf32a6fa0039204c8edd52f63957d03e14136b98f246e9626af97a34a5_2021-01-14__000230._exe.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:2036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-3-0x000007FEF7B10000-0x000007FEF7D8A000-memory.dmp

Filesize
2.5MB

Download
memory/2036-2-0x0000000000000000-mapping.dmp

Download