1a0dbe107464310b9edcf3f39d2b63b3a7e2b93fca51422515483aabf9f92cb8 | Triage

Analysis

max time kernel
59s
max time network
127s
platform
windows10_x64
resource
win10v20201028
submitted
14-01-2021 00:06

Sharing

Report Analysis Logs

General

Target

emotet_exe_e2_1a0dbe107464310b9edcf3f39d2b63b3a7e2b93fca51422515483aabf9f92cb8_2021-01-14__000605._exe.dll
Size

273KB
MD5

fd805fbaf310fb9fb14b8cdbfe9ff70d
SHA1

37159ad08c647702e393d47e492d6ea635fc43a1
SHA256

1a0dbe107464310b9edcf3f39d2b63b3a7e2b93fca51422515483aabf9f92cb8
SHA512

f0e9fa0ad85a66dcded4f2c6ea22e74a90e8767560c4f26cefac28d3a0a553e2feb0d1c257f6d4e2b62bcbb87068f2480ca25ab3feb8293f9b899a3b008bce32

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

14 3876 rundll32.exe
15 3876 rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

3876 rundll32.exe
3876 rundll32.exe
3876 rundll32.exe
3876 rundll32.exe
3876 rundll32.exe
3876 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3988 wrote to memory of 3876	3988	rundll32.exe	rundll32.exe
PID 3988 wrote to memory of 3876	3988	rundll32.exe	rundll32.exe
PID 3988 wrote to memory of 3876	3988	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_1a0dbe107464310b9edcf3f39d2b63b3a7e2b93fca51422515483aabf9f92cb8_2021-01-14__000605._exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3988

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_1a0dbe107464310b9edcf3f39d2b63b3a7e2b93fca51422515483aabf9f92cb8_2021-01-14__000605._exe.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:3876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3876-2-0x0000000000000000-mapping.dmp

Download