emotet | d9fccbed3f0ed3f14b0c522d088a630e118e7da9294d9f7d2c2ea5102ffa8cd8

Analysis

max time kernel
148s
max time network
155s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d50814f570cce66b3de369bbd253926_JaffaCakes118.dll
Size

340KB
MD5

4d50814f570cce66b3de369bbd253926
SHA1

1c93c582da50939fb1cd19a71a9fa6de622f2d8c
SHA256

d9fccbed3f0ed3f14b0c522d088a630e118e7da9294d9f7d2c2ea5102ffa8cd8
SHA512

ab38434d0b3a885d892ee8bc5edfc2114e6a5e214aa3763783b9d5ed463605d51337f75cec081366441d0fdf0338b239079f530160af3ddf25ed76796e880b0c
SSDEEP

3072:MvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:M206xWgGxLxWN40PDKR/JnX2P

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

69.38.130.14:80

195.159.28.230:8080

162.241.204.233:8080

115.21.224.117:80

78.189.148.42:80

181.165.68.127:80

78.188.225.105:80

161.0.153.60:80

89.106.251.163:80

172.125.40.123:80

5.39.91.110:7080

110.145.11.73:80

190.251.200.206:80

144.217.7.207:7080

75.109.111.18:80

75.177.207.146:80

139.59.60.244:8080

70.183.211.3:80

95.213.236.64:8080

61.19.246.238:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 6 IoCs

flow	pid	Process
3	1164	rundll32.exe
5	1164	rundll32.exe
8	1164	rundll32.exe
11	1164	rundll32.exe
12	1164	rundll32.exe
13	1164	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1164	rundll32.exe
1164	rundll32.exe
1164	rundll32.exe
1164	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 1164	760	rundll32.exe	29
PID 760 wrote to memory of 1164	760	rundll32.exe	29
PID 760 wrote to memory of 1164	760	rundll32.exe	29
PID 760 wrote to memory of 1164	760	rundll32.exe	29
PID 760 wrote to memory of 1164	760	rundll32.exe	29
PID 760 wrote to memory of 1164	760	rundll32.exe	29
PID 760 wrote to memory of 1164	760	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d50814f570cce66b3de369bbd253926_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d50814f570cce66b3de369bbd253926_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1164-1-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/1164-0-0x00000000000B0000-0x00000000000D0000-memory.dmp

Filesize
128KB

Download
memory/1164-2-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/1164-3-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download