Analysis

  • max time kernel
    62s
  • max time network
    128s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    14-01-2021 00:07

General

  • Target

    emotet_exe_e2_f357249f8bdc0335708c70854c7e2dbe8b3230b5e7c83590eeb75295dea62dab_2021-01-14__000606.exe.dll

  • Size

    273KB

  • MD5

    5a13b56f077daf84bdadf3581001a0e1

  • SHA1

    d7f34272232fe1cc3f06ba55d30cd9c1470b0f9a

  • SHA256

    f357249f8bdc0335708c70854c7e2dbe8b3230b5e7c83590eeb75295dea62dab

  • SHA512

    99b995312c97d72509441c8b026dbdf34a6b3d6f3612b772515f1918db52c677a924170020862d5fd00e3f981a7cc21a65fe2ff6669bbe5d1ae2f5f7b1a82b25

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_f357249f8bdc0335708c70854c7e2dbe8b3230b5e7c83590eeb75295dea62dab_2021-01-14__000606.exe.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4684
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_f357249f8bdc0335708c70854c7e2dbe8b3230b5e7c83590eeb75295dea62dab_2021-01-14__000606.exe.dll,#1
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      PID:4868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4868-2-0x0000000000000000-mapping.dmp