3e9585d1e4110d04d74130e2c565545148022c777a4f9d5580f7dc9411e63b53 | Triage

Analysis

max time kernel
18s
max time network
135s
platform
windows7_x64
resource
win7v20201028
submitted
14-01-2021 00:02

Sharing

Report Analysis Logs

General

Target

emotet_exe_e3_3e9585d1e4110d04d74130e2c565545148022c777a4f9d5580f7dc9411e63b53_2021-01-14__000230._exe.dll
Size

278KB
MD5

76faf47f5f53242f1c1e32a32660066f
SHA1

c40664f4ebda62f98bd3096dcd39ac3960d2193c
SHA256

3e9585d1e4110d04d74130e2c565545148022c777a4f9d5580f7dc9411e63b53
SHA512

1523777a3b588769d52e0041aae73a9abc88bbb81076397a1a92602d9e9eb1f36a00bbf0d95a9c8d42182e0d668febcccc5fa496a5a0d2692fe7c956db24a95c

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

5 1084 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1084 rundll32.exe
1084 rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 848 wrote to memory of 1084	848	rundll32.exe	rundll32.exe
PID 848 wrote to memory of 1084	848	rundll32.exe	rundll32.exe
PID 848 wrote to memory of 1084	848	rundll32.exe	rundll32.exe
PID 848 wrote to memory of 1084	848	rundll32.exe	rundll32.exe
PID 848 wrote to memory of 1084	848	rundll32.exe	rundll32.exe
PID 848 wrote to memory of 1084	848	rundll32.exe	rundll32.exe
PID 848 wrote to memory of 1084	848	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_3e9585d1e4110d04d74130e2c565545148022c777a4f9d5580f7dc9411e63b53_2021-01-14__000230._exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:848

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_3e9585d1e4110d04d74130e2c565545148022c777a4f9d5580f7dc9411e63b53_2021-01-14__000230._exe.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1084-2-0x0000000000000000-mapping.dmp

Download
memory/1212-3-0x000007FEF7850000-0x000007FEF7ACA000-memory.dmp

Filesize
2.5MB

Download