emotet | 6b14a533653d8535dc86e29deca21ba3266ab9088b2d7cf08cb96993136356cc | Triage

Sharing

General

Target

6b14a533653d8535dc86e29deca21ba3266ab9088b2d7cf08cb96993136356cc
Size

58KB
MD5

2969958cda104c3c7b8fa66e1dd94b75
SHA1

875ed549c0d9e6e1ae8bc3b49c7b04b01dd5fe35
SHA256

6b14a533653d8535dc86e29deca21ba3266ab9088b2d7cf08cb96993136356cc
SHA512

0484fff46ccbf55a69bc8bfc3bc1b1582992c15f7f288343128997b3dfbda18db1d0fe9648922537c1799990d74a52794a6411eb088334f388c909b237f768f7

Score

10^/10

trojan banker emotet

Malware Config

Signatures

Emotet Payload 1 IoCs
Detects Emotet payload in memory.
trojan banker

Processes:

resource yara_rule

sample emotet
Emotet family
emotet

Files

6b14a533653d8535dc86e29deca21ba3266ab9088b2d7cf08cb96993136356cc
.dll windows x86

8f9a124a88878ac62589c50d13924ff4

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

qsort
bsearch
wcslen

kernel32

VirtualFree
Process32Next
Process32First
CreateToolhelp32Snapshot
CloseHandle
SetLastError
HeapAlloc
HeapFree
GetProcessHeap
ExitProcess
VirtualAlloc
VirtualProtect
VirtualQuery
FreeLibrary
GetProcAddress
LoadLibraryA
LoadLibraryW
IsBadReadPtr

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ