emotet | d2177f0737d224a8114df0ef8757c78c480077abb3423a8a1a0a4ccd33ccd5f9

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b5b8dd7662263d93bb6bd075ebb8cb0_JaffaCakes118.dll
Size

340KB
MD5

5b5b8dd7662263d93bb6bd075ebb8cb0
SHA1

8f6e121ea4090701e6a88d3ddeb8c20440013586
SHA256

d2177f0737d224a8114df0ef8757c78c480077abb3423a8a1a0a4ccd33ccd5f9
SHA512

1ed9e24a59425bb0875f2342f63dc23a908d927986dc85dd1a10f393726d49a170e20a690e480ea3c84397ccc7d0c1e69626101f96a18cb75f5a8b19331432d5
SSDEEP

3072:nvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:n206xWgGxLxWN40PDKR/JnX2P

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

69.38.130.14:80

195.159.28.230:8080

162.241.204.233:8080

115.21.224.117:80

78.189.148.42:80

181.165.68.127:80

78.188.225.105:80

161.0.153.60:80

89.106.251.163:80

172.125.40.123:80

5.39.91.110:7080

110.145.11.73:80

190.251.200.206:80

144.217.7.207:7080

75.109.111.18:80

75.177.207.146:80

139.59.60.244:8080

70.183.211.3:80

95.213.236.64:8080

61.19.246.238:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 6 IoCs

flow	pid	Process
3	2676	rundll32.exe
5	2676	rundll32.exe
8	2676	rundll32.exe
9	2676	rundll32.exe
12	2676	rundll32.exe
13	2676	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2676	rundll32.exe
2676	rundll32.exe
2676	rundll32.exe
2676	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2676	2636	rundll32.exe	30
PID 2636 wrote to memory of 2676	2636	rundll32.exe	30
PID 2636 wrote to memory of 2676	2636	rundll32.exe	30
PID 2636 wrote to memory of 2676	2636	rundll32.exe	30
PID 2636 wrote to memory of 2676	2636	rundll32.exe	30
PID 2636 wrote to memory of 2676	2636	rundll32.exe	30
PID 2636 wrote to memory of 2676	2636	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b5b8dd7662263d93bb6bd075ebb8cb0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b5b8dd7662263d93bb6bd075ebb8cb0_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:2676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2676-1-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/2676-0-0x0000000000130000-0x0000000000150000-memory.dmp

Filesize
128KB

Download
memory/2676-2-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/2676-3-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download