Analysis

  • max time kernel
    14s
  • max time network
    123s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    14-01-2021 00:03

General

  • Target

    emotet_exe_e3_3e9585d1e4110d04d74130e2c565545148022c777a4f9d5580f7dc9411e63b53_2021-01-14__000230.exe.dll

  • Size

    278KB

  • MD5

    76faf47f5f53242f1c1e32a32660066f

  • SHA1

    c40664f4ebda62f98bd3096dcd39ac3960d2193c

  • SHA256

    3e9585d1e4110d04d74130e2c565545148022c777a4f9d5580f7dc9411e63b53

  • SHA512

    1523777a3b588769d52e0041aae73a9abc88bbb81076397a1a92602d9e9eb1f36a00bbf0d95a9c8d42182e0d668febcccc5fa496a5a0d2692fe7c956db24a95c

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_3e9585d1e4110d04d74130e2c565545148022c777a4f9d5580f7dc9411e63b53_2021-01-14__000230.exe.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:756
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_3e9585d1e4110d04d74130e2c565545148022c777a4f9d5580f7dc9411e63b53_2021-01-14__000230.exe.dll,#1
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      PID:3244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3244-2-0x0000000000000000-mapping.dmp