emotet | 613757939059b31e584a008a963586f9d7c39f6fdc0a38ef7fd23d7fde29b47c

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

692ff17bb8f697a3c048c53d8f7f4554_JaffaCakes118.dll
Size

340KB
MD5

692ff17bb8f697a3c048c53d8f7f4554
SHA1

e7c6c93eadf7e3dc2c2171fe5a0abbedb881af24
SHA256

613757939059b31e584a008a963586f9d7c39f6fdc0a38ef7fd23d7fde29b47c
SHA512

bc4651b3a24c5bc0a0f8bdc617be21377e0217a0c916d77718a641009bab04bd30a99d608b05fb02b1da4c4fbb04db8b5088c2161a3c99b8c547b0534281721c
SSDEEP

3072:evA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/J+XCtT:e206xWgGxLxWN40PDKR/J+XaT

Score

10^/10

emotet epoch2 banker discovery trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

108.53.88.101:443

195.159.28.230:8080

162.241.204.233:8080

74.40.205.197:443

93.146.48.84:80

78.189.148.42:80

139.99.158.11:443

61.19.246.238:443

37.139.21.175:8080

118.83.154.64:443

85.105.205.77:8080

176.111.60.55:8080

50.116.111.59:8080

75.109.111.18:80

181.165.68.127:80

78.182.254.231:80

110.145.101.66:443

24.179.13.119:80

121.124.124.40:7080

115.21.224.117:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 6 IoCs

flow	pid	Process
3	3012	rundll32.exe
5	3012	rundll32.exe
8	3012	rundll32.exe
11	3012	rundll32.exe
12	3012	rundll32.exe
13	3012	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3012	rundll32.exe
3012	rundll32.exe
3012	rundll32.exe
3012	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 3012	1280	rundll32.exe	31
PID 1280 wrote to memory of 3012	1280	rundll32.exe	31
PID 1280 wrote to memory of 3012	1280	rundll32.exe	31
PID 1280 wrote to memory of 3012	1280	rundll32.exe	31
PID 1280 wrote to memory of 3012	1280	rundll32.exe	31
PID 1280 wrote to memory of 3012	1280	rundll32.exe	31
PID 1280 wrote to memory of 3012	1280	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\692ff17bb8f697a3c048c53d8f7f4554_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\692ff17bb8f697a3c048c53d8f7f4554_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3012-0-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/3012-1-0x0000000000190000-0x00000000001B0000-memory.dmp

Filesize
128KB

Download
memory/3012-2-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/3012-3-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download