emotet | 32333a4d56f8a4278e64bc3eeee8395c573277de1fc60aeccaf6f45dec0167d0

Analysis

max time kernel
132s
max time network
144s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 22:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5dfeccaba66de64e4e0afee7207b23b6_JaffaCakes118.dll
Size

340KB
MD5

5dfeccaba66de64e4e0afee7207b23b6
SHA1

8856213fa25e566a10c5a113787a9c6ab1b8fef2
SHA256

32333a4d56f8a4278e64bc3eeee8395c573277de1fc60aeccaf6f45dec0167d0
SHA512

d19eb83781a038f6ec31ab0ee4ccb6092b98a4333b3c4778c90748099a9ab498f8bff25e8d32ef5e38fa455929d66717ef1dfcb56744826831fba7b0df24fb11
SSDEEP

3072:8vA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:8206xWgGxLxWN40PDKR/JnX2P

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

69.38.130.14:80

195.159.28.230:8080

162.241.204.233:8080

115.21.224.117:80

78.189.148.42:80

181.165.68.127:80

78.188.225.105:80

161.0.153.60:80

89.106.251.163:80

172.125.40.123:80

5.39.91.110:7080

110.145.11.73:80

190.251.200.206:80

144.217.7.207:7080

75.109.111.18:80

75.177.207.146:80

139.59.60.244:8080

70.183.211.3:80

95.213.236.64:8080

61.19.246.238:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 6 IoCs

flow	pid	Process
4	2404	rundll32.exe
5	2404	rundll32.exe
6	2404	rundll32.exe
7	2404	rundll32.exe
8	2404	rundll32.exe
9	2404	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2404	rundll32.exe
2404	rundll32.exe
2404	rundll32.exe
2404	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2404	2196	rundll32.exe	31
PID 2196 wrote to memory of 2404	2196	rundll32.exe	31
PID 2196 wrote to memory of 2404	2196	rundll32.exe	31
PID 2196 wrote to memory of 2404	2196	rundll32.exe	31
PID 2196 wrote to memory of 2404	2196	rundll32.exe	31
PID 2196 wrote to memory of 2404	2196	rundll32.exe	31
PID 2196 wrote to memory of 2404	2196	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5dfeccaba66de64e4e0afee7207b23b6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5dfeccaba66de64e4e0afee7207b23b6_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:2404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2404-1-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/2404-0-0x00000000001B0000-0x00000000001D0000-memory.dmp

Filesize
128KB

Download
memory/2404-2-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/2404-3-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download