emotet | af3e2868c1323b2ab6a3b895f949f199a103f2a6d3a7ff28f3df6ea7db0ef51f | Triage

Sharing

General

Target

af3e2868c1323b2ab6a3b895f949f199a103f2a6d3a7ff28f3df6ea7db0ef51f
Size

124KB
MD5

d3991e339e53faff49e4a611161314fc
SHA1

a76ee4a4a372d979e4d5203381e81ac8db7bcb86
SHA256

af3e2868c1323b2ab6a3b895f949f199a103f2a6d3a7ff28f3df6ea7db0ef51f
SHA512

c4aa45e8d7a2e34a683616b762a766cb62f85279d35a0bd007579c5e50dcbceb44eed1d9bea4974a0a3f1754186c509be110c5f0146562fa6a002cc37f0be484

Score

10^/10

trojan banker emotet

Malware Config

Signatures

Emotet Payload 1 IoCs
Detects Emotet payload in memory.
trojan banker

Processes:

resource yara_rule

sample emotet
Emotet family
emotet

Files

af3e2868c1323b2ab6a3b895f949f199a103f2a6d3a7ff28f3df6ea7db0ef51f
.dll windows x86

8f9a124a88878ac62589c50d13924ff4

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

qsort
bsearch
wcslen

kernel32

VirtualFree
Process32Next
Process32First
CreateToolhelp32Snapshot
CloseHandle
SetLastError
HeapAlloc
HeapFree
GetProcessHeap
ExitProcess
VirtualAlloc
VirtualProtect
VirtualQuery
FreeLibrary
GetProcAddress
LoadLibraryA
LoadLibraryW
IsBadReadPtr

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ