emotet | 3257523adb8c8f0384699439296a74c4c54318d231805dec30028d364f5b7d80

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 10:26

Target
5b8bb50ecb0da6ec68943efc56d325a0_JaffaCakes118.dll
Size 330KB
Sample240719-mgw4vazdkc
SHA256 3257523adb8c8f0384699439296a74c4c54318d231805dec30028d364f5b7d80
MD5 5b8bb50ecb0da6ec68943efc56d325a0
SHA1 ea18179fead0effb199e566a359d33725a638e99
SHA512 8a16db00598e5b664ac1c796dc74d6be670b236111a4eb9f1ed02282e2c2ea3d0e409dfa894a249e84f805b23161f1d35fef1c7561a515dd14e0938817e93d56
SSDEEP 3072:DRq1sFAd2gQ5PmBvNZwnnq1gn2RvoXiDzAYgrO1v2F5j8LZ9:lq1sFAwgwmBv3wnIgG4oAYxvU54l9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Botnet

rsa_pubkey.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 1 IoCs

flow	pid	Process
60	1032	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 1032	4776	rundll32.exe	84
PID 4776 wrote to memory of 1032	4776	rundll32.exe	84
PID 4776 wrote to memory of 1032	4776	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b8bb50ecb0da6ec68943efc56d325a0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b8bb50ecb0da6ec68943efc56d325a0_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1032

memory/1032-0-0x0000000000A60000-0x0000000000A7F000-memory.dmp

Download

memory/1032-1-0x0000000010000000-0x0000000010023000-memory.dmp

Download

memory/1032-2-0x0000000010000000-0x0000000010023000-memory.dmp

Download