emotet | a87f1ac10a182aeb3a0563304677987ace7a75bd9a20b36bedf5eeb6d8731a4e

Analysis

Target
emotet_exe_e3_a87f1ac10a182aeb3a0563304677987ace7a75bd9a20b36bedf5eeb6d8731a4e_2021-01-23__000050.exe.dll
Size 330KB
Sample210123-ey3d729kas
SHA256 a87f1ac10a182aeb3a0563304677987ace7a75bd9a20b36bedf5eeb6d8731a4e
MD5 4df34d1750474f843c8ac679cc456065
SHA1 d5c6f0ec37fe02fb33561636844ca8b82b921edf
SHA512 45c9e774c298d33421a8a6683532d275895fb94acda41f0d613d00f7710ad3cec8b5b538cd88f0da6a49eb4d92fd5c5b08c09009e00f13aff6eab24708386e2b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

rsa_pubkey.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 1 IoCs

flow	pid	Process
16	788	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 788	4056	rundll32.exe	68
PID 4056 wrote to memory of 788	4056	rundll32.exe	68
PID 4056 wrote to memory of 788	4056	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_a87f1ac10a182aeb3a0563304677987ace7a75bd9a20b36bedf5eeb6d8731a4e_2021-01-23__000050.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_a87f1ac10a182aeb3a0563304677987ace7a75bd9a20b36bedf5eeb6d8731a4e_2021-01-23__000050.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:788

memory/788-3-0x0000000000BF0000-0x0000000000C0F000-memory.dmp

Download

memory/788-4-0x0000000010000000-0x0000000010023000-memory.dmp

Download