emotet_exe_e1_4fa67b147d6b2bce7adc776d88917a6b3a40bcd1858e1dbe113c385cb34a67a2_2021-01-14__000142._exe

General
Target

emotet_exe_e1_4fa67b147d6b2bce7adc776d88917a6b3a40bcd1858e1dbe113c385cb34a67a2_2021-01-14__000142._exe.dll

Filesize

271KB

Completed

14-01-2021 00:02

Score
8 /10
MD5

662d2aba9cb5182eb12d2a6acf3296ae

SHA1

090bb4411eff974e9c191e02ac7af95f6f7c7f35

SHA256

4fa67b147d6b2bce7adc776d88917a6b3a40bcd1858e1dbe113c385cb34a67a2

Malware Config
Signatures 3

Filter: none

  • Blocklisted process makes network request
    rundll32.exe

    Reported IOCs

    flowpidprocess
    152188rundll32.exe
    182188rundll32.exe
  • Suspicious behavior: EnumeratesProcesses
    rundll32.exe

    Reported IOCs

    pidprocess
    2188rundll32.exe
    2188rundll32.exe
    2188rundll32.exe
    2188rundll32.exe
    2188rundll32.exe
    2188rundll32.exe
  • Suspicious use of WriteProcessMemory
    rundll32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3928 wrote to memory of 21883928rundll32.exerundll32.exe
    PID 3928 wrote to memory of 21883928rundll32.exerundll32.exe
    PID 3928 wrote to memory of 21883928rundll32.exerundll32.exe
Processes 2
  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_4fa67b147d6b2bce7adc776d88917a6b3a40bcd1858e1dbe113c385cb34a67a2_2021-01-14__000142._exe.dll,#1
    Suspicious use of WriteProcessMemory
    PID:3928
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_4fa67b147d6b2bce7adc776d88917a6b3a40bcd1858e1dbe113c385cb34a67a2_2021-01-14__000142._exe.dll,#1
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      PID:2188
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/2188-2-0x0000000000000000-mapping.dmp