emotet | 55e6d41d1e9fad0c9990ad7b5be00def0d122b20b62b429651810a8dbcc169e5

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 06:44

Target
29cd05be9c850a9630224eec8f5974ad_JaffaCakes118.dll
Size 330KB
Sample240707-hhtmwswdpr
SHA256 55e6d41d1e9fad0c9990ad7b5be00def0d122b20b62b429651810a8dbcc169e5
MD5 29cd05be9c850a9630224eec8f5974ad
SHA1 74f9cfb47bacba737393e280fd77aa50f99bd722
SHA512 dc3137a60f142e5dedf837ce44ad6f219575dd07a19659b149457b1b018f3f1ed64951e37c676258306cb4861da2570ee970263fb94187096465300dcc52deb3
SSDEEP 3072:ERq1sFAd2gQ5PmBvNZwnnq1gn2RvoXiDzAYgrO1v2F5j8eFu:2q1sFAwgwmBv3wnIgG4oAYxvU54eu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

rsa_pubkey.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 1 IoCs

flow	pid	Process
13	1848	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 1848	840	rundll32.exe	81
PID 840 wrote to memory of 1848	840	rundll32.exe	81
PID 840 wrote to memory of 1848	840	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\29cd05be9c850a9630224eec8f5974ad_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\29cd05be9c850a9630224eec8f5974ad_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1848

memory/1848-0-0x0000000001230000-0x000000000124F000-memory.dmp

Download

memory/1848-1-0x0000000010000000-0x0000000010023000-memory.dmp

Download

memory/1848-2-0x0000000010000000-0x0000000010023000-memory.dmp

Download