emotet | 53fbfe8f4a4919dcf2aca7a261f9569e67aaee05f65f5ec630142caa3aaaa00a

Analysis

max time kernel
141s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/06/2024, 10:10

Target
0193dc55b9a7cc6cdacfb48cfc1b676c_JaffaCakes118.dll
Size 330KB
Sample240622-l7npqaxejp
SHA256 53fbfe8f4a4919dcf2aca7a261f9569e67aaee05f65f5ec630142caa3aaaa00a
MD5 0193dc55b9a7cc6cdacfb48cfc1b676c
SHA1 2049afae236cfb13bb6852e862ac4b961432a618
SHA512 0ed4ca03a17b648c4e7a5d3d86099fb3d3ac7ca69db6084eb90587033a5eb8a9af5a7e60db6a4eb5e3694a478cefedc3c40e8b336a7d8c851f6d66742c6c8a67
SSDEEP 3072:qRq1sFAd2gQ5PmBvNZwnnq1gn2RvoXiDzAYgrO1v2F5j8eFu:kq1sFAwgwmBv3wnIgG4oAYxvU54eu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

rsa_pubkey.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 1 IoCs

flow	pid	Process
14	3740	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 3740	4660	rundll32.exe	81
PID 4660 wrote to memory of 3740	4660	rundll32.exe	81
PID 4660 wrote to memory of 3740	4660	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0193dc55b9a7cc6cdacfb48cfc1b676c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0193dc55b9a7cc6cdacfb48cfc1b676c_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3740

memory/3740-1-0x0000000010000000-0x0000000010023000-memory.dmp

Download

memory/3740-0-0x0000000000730000-0x000000000074F000-memory.dmp

Download

memory/3740-2-0x0000000010000000-0x0000000010023000-memory.dmp

Download