emotet | c287453d0df6418268060ee6694417b29d2f6643419b94212ade640bb47c5940

Analysis

max time kernel
150s
max time network
139s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15465bec80cf938f607715e430706a54_JaffaCakes118.exe
Size

408KB
MD5

15465bec80cf938f607715e430706a54
SHA1

3e23469886dbd86864b8f11f148d62a80945a475
SHA256

c287453d0df6418268060ee6694417b29d2f6643419b94212ade640bb47c5940
SHA512

deae0154b679607516d82dd19a8d66463e8fc282f7c656736a04ee905c2cac8ba4f834836e618d2c71d530129c44ca72c10710edf022b18a0505bb676fdf8d93
SSDEEP

6144:YZDhw/NG+86gQ/FGz8C0mDwwQYuzz3J7asoU:YZ9w/NVzXwQYuzz3JDl

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

38.18.235.242:80

5.196.108.189:8080

121.124.124.40:7080

104.236.246.93:8080

113.61.66.94:80

120.150.60.189:80

91.211.88.52:7080

47.144.21.12:443

108.46.29.236:80

139.162.108.71:8080

134.209.36.254:8080

139.59.60.244:8080

66.65.136.14:80

76.175.162.101:80

174.106.122.139:80

95.213.236.64:8080

174.45.13.118:80

50.35.17.13:80

209.141.54.221:8080

87.106.139.101:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet payload 2 IoCs

Detects Emotet payload in memory.

trojan banker

Processes:

resource	yara_rule
behavioral1/memory/2344-17-0x0000000000350000-0x0000000000360000-memory.dmp	emotet
behavioral1/memory/2344-22-0x0000000000350000-0x0000000000360000-memory.dmp	emotet

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

15465bec80cf938f607715e430706a54_JaffaCakes118.exe

pid	process
2344	15465bec80cf938f607715e430706a54_JaffaCakes118.exe
2344	15465bec80cf938f607715e430706a54_JaffaCakes118.exe
2344	15465bec80cf938f607715e430706a54_JaffaCakes118.exe
2344	15465bec80cf938f607715e430706a54_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

15465bec80cf938f607715e430706a54_JaffaCakes118.exe

pid process

2344 15465bec80cf938f607715e430706a54_JaffaCakes118.exe
2344 15465bec80cf938f607715e430706a54_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\15465bec80cf938f607715e430706a54_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\15465bec80cf938f607715e430706a54_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2344-3-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download
memory/2344-4-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download
memory/2344-5-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download
memory/2344-6-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download
memory/2344-7-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download
memory/2344-8-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download
memory/2344-9-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download
memory/2344-10-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download
memory/2344-11-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download
memory/2344-12-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download
memory/2344-13-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download
memory/2344-14-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download
memory/2344-15-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download
memory/2344-16-0x0000000000439000-0x000000000043A000-memory.dmp

Filesize
4KB

Download
memory/2344-17-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2344-21-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2344-22-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download