emotet | 9302eab8d4da0a9a4f2b2381a14145d5b66c779c72beb1e3cdda559b0c384685

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
17/07/2024, 14:01

Target
534b4f81b217f43df96c7522344ec9f1_JaffaCakes118.dll
Size 330KB
Sample240717-rbhfqatepm
SHA256 9302eab8d4da0a9a4f2b2381a14145d5b66c779c72beb1e3cdda559b0c384685
MD5 534b4f81b217f43df96c7522344ec9f1
SHA1 6d4baecc4c4e61f25a6281db423ceca7bd594707
SHA512 77bd1d7609ba8ccf06acf781b517dea917bebd854adb220396a386bac220769f9305452d1c2899ed2590346657e8a25d8269e953a1af7513596efbc9f78620e2
SSDEEP 3072:cRq1sFAd2gQ5PmBvNZwnnq1gn2RvoXiDzAYgrO1v2F5j8eFu:uq1sFAwgwmBv3wnIgG4oAYxvU54eu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

rsa_pubkey.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 1 IoCs

flow	pid	Process
62	2004	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2004	1944	rundll32.exe	84
PID 1944 wrote to memory of 2004	1944	rundll32.exe	84
PID 1944 wrote to memory of 2004	1944	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\534b4f81b217f43df96c7522344ec9f1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\534b4f81b217f43df96c7522344ec9f1_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:2004

memory/2004-0-0x00000000006B0000-0x00000000006CF000-memory.dmp

Download

memory/2004-1-0x0000000010000000-0x0000000010023000-memory.dmp

Download

memory/2004-2-0x0000000010000000-0x0000000010023000-memory.dmp

Download