emotet | 0d0b317420112ffb30b880697436d9faea206010630eefd99b7dbda504cf5899

Analysis

max time kernel
132s
max time network
147s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 09:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62a81161d36c88834b0742261ff32a74_JaffaCakes118.dll
Size

340KB
MD5

62a81161d36c88834b0742261ff32a74
SHA1

505042ae9dfa02c962471d2b464c9a08f40ed366
SHA256

0d0b317420112ffb30b880697436d9faea206010630eefd99b7dbda504cf5899
SHA512

f796182f595531ff8aba3aad385edceb59a8f0b3b9eb84bb42bd6615d362103ba5e9f80c7f031b66f292f47f749b6124c5ef551b0c3ecde90853df23d3350fa8
SSDEEP

3072:qvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:q206xWgGxLxWN40PDKR/JnX2P

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

69.38.130.14:80

195.159.28.230:8080

162.241.204.233:8080

115.21.224.117:80

78.189.148.42:80

181.165.68.127:80

78.188.225.105:80

161.0.153.60:80

89.106.251.163:80

172.125.40.123:80

5.39.91.110:7080

110.145.11.73:80

190.251.200.206:80

144.217.7.207:7080

75.109.111.18:80

75.177.207.146:80

139.59.60.244:8080

70.183.211.3:80

95.213.236.64:8080

61.19.246.238:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 6 IoCs

flow	pid	Process
3	3020	rundll32.exe
7	3020	rundll32.exe
8	3020	rundll32.exe
9	3020	rundll32.exe
12	3020	rundll32.exe
13	3020	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3020	rundll32.exe
3020	rundll32.exe
3020	rundll32.exe
3020	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 3020	2056	rundll32.exe	29
PID 2056 wrote to memory of 3020	2056	rundll32.exe	29
PID 2056 wrote to memory of 3020	2056	rundll32.exe	29
PID 2056 wrote to memory of 3020	2056	rundll32.exe	29
PID 2056 wrote to memory of 3020	2056	rundll32.exe	29
PID 2056 wrote to memory of 3020	2056	rundll32.exe	29
PID 2056 wrote to memory of 3020	2056	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\62a81161d36c88834b0742261ff32a74_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\62a81161d36c88834b0742261ff32a74_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3020-0-0x0000000000160000-0x0000000000180000-memory.dmp

Filesize
128KB

Download
memory/3020-1-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/3020-2-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/3020-3-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download