Analysis

  • max time kernel
    43s
  • max time network
    52s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    14-01-2021 00:01

General

  • Target

    emotet_exe_e1_79458b5fb130ddafe84e085fa6987bf389a846e6499269370c53f78aa2ae9ed2_2021-01-14__000140._exe.dll

  • Size

    271KB

  • MD5

    5a4073fe86af42abcc1304649c4eb19f

  • SHA1

    86f82797ab185db9ddbb3faea7394c9bc11fde61

  • SHA256

    79458b5fb130ddafe84e085fa6987bf389a846e6499269370c53f78aa2ae9ed2

  • SHA512

    8081c2d4f8837ca94632c50ffbf31d1b04adcc5d9116c267c5f0ed5a3fe109b924659014170529fccc12542d31853c593bc9d0fef10c242271a5dd85378a57d1

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_79458b5fb130ddafe84e085fa6987bf389a846e6499269370c53f78aa2ae9ed2_2021-01-14__000140._exe.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1124
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_79458b5fb130ddafe84e085fa6987bf389a846e6499269370c53f78aa2ae9ed2_2021-01-14__000140._exe.dll,#1
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1720-2-0x0000000000000000-mapping.dmp