emotet | e96a59cb60d08e5381e99bc241e744f3b7d2d42550ec44d08543c9e76ba33543

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 09:22

Target
199bac50bc0b1857800df67f010a6828_JaffaCakes118.dll
Size 330KB
Sample240628-lca55svcql
SHA256 e96a59cb60d08e5381e99bc241e744f3b7d2d42550ec44d08543c9e76ba33543
MD5 199bac50bc0b1857800df67f010a6828
SHA1 af84147edaa63899a2f6442c4be84d4f778fb932
SHA512 ea884fac64af6612925224c3a426372f1626624246afc9b331dc8cce0a6f00fe7224e50b978170bfb7856fb7779a3f662b046a51ea55c30325977b44b10f9fb3
SSDEEP 3072:MRq1sFAd2gQ5PmBvNZwnnq1gn2RvoXiDzAYgrO1v2F5j8eFu:eq1sFAwgwmBv3wnIgG4oAYxvU54eu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

rsa_pubkey.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 1 IoCs

flow	pid	Process
11	3724	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 3724	2532	rundll32.exe	82
PID 2532 wrote to memory of 3724	2532	rundll32.exe	82
PID 2532 wrote to memory of 3724	2532	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\199bac50bc0b1857800df67f010a6828_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\199bac50bc0b1857800df67f010a6828_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3724

memory/3724-0-0x0000000000860000-0x000000000087F000-memory.dmp

Download

memory/3724-1-0x0000000010000000-0x0000000010023000-memory.dmp

Download

memory/3724-2-0x0000000010000000-0x0000000010023000-memory.dmp

Download