emotet | 5295b0334acae49c53332952aa16e1429648e75639f5b067df17264d8b6539e3

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 08:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad78d48dba70f3e5b408b100a1538522_JaffaCakes118.exe
Size

408KB
MD5

ad78d48dba70f3e5b408b100a1538522
SHA1

0ea8773faef1a99d6792c8f8f0a930396268332e
SHA256

5295b0334acae49c53332952aa16e1429648e75639f5b067df17264d8b6539e3
SHA512

51233afed51992d527cfcef22215a3051ca534bb8f1a7b07bc9e7fa7480f4842087d2134e1ea73391e4bb76b473d5171864651b69e6771f96aba65802c302042
SSDEEP

6144:YZDhw/Nx+86gQ/FGz8C0mDwwQYuzz3J7asoU:YZ9w/NEzXwQYuzz3JDl

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

38.18.235.242:80

5.196.108.189:8080

121.124.124.40:7080

104.236.246.93:8080

113.61.66.94:80

120.150.60.189:80

91.211.88.52:7080

47.144.21.12:443

108.46.29.236:80

139.162.108.71:8080

134.209.36.254:8080

139.59.60.244:8080

66.65.136.14:80

76.175.162.101:80

174.106.122.139:80

95.213.236.64:8080

174.45.13.118:80

50.35.17.13:80

209.141.54.221:8080

87.106.139.101:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet payload 2 IoCs
Detects Emotet payload in memory.
trojan banker

Processes:

resource yara_rule

behavioral1/memory/1744-17-0x0000000000390000-0x00000000003A0000-memory.dmp emotet
behavioral1/memory/1744-22-0x0000000000390000-0x00000000003A0000-memory.dmp emotet

resource	yara_rule
behavioral1/memory/1744-17-0x0000000000390000-0x00000000003A0000-memory.dmp	emotet
behavioral1/memory/1744-22-0x0000000000390000-0x00000000003A0000-memory.dmp	emotet

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

ad78d48dba70f3e5b408b100a1538522_JaffaCakes118.exe

pid	process
1744	ad78d48dba70f3e5b408b100a1538522_JaffaCakes118.exe
1744	ad78d48dba70f3e5b408b100a1538522_JaffaCakes118.exe
1744	ad78d48dba70f3e5b408b100a1538522_JaffaCakes118.exe
1744	ad78d48dba70f3e5b408b100a1538522_JaffaCakes118.exe
1744	ad78d48dba70f3e5b408b100a1538522_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ad78d48dba70f3e5b408b100a1538522_JaffaCakes118.exe

pid process

1744 ad78d48dba70f3e5b408b100a1538522_JaffaCakes118.exe
1744 ad78d48dba70f3e5b408b100a1538522_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ad78d48dba70f3e5b408b100a1538522_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ad78d48dba70f3e5b408b100a1538522_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1744-3-0x0000000000370000-0x0000000000372000-memory.dmp

Filesize
8KB

Download
memory/1744-4-0x0000000000370000-0x0000000000372000-memory.dmp

Filesize
8KB

Download
memory/1744-5-0x0000000000370000-0x0000000000372000-memory.dmp

Filesize
8KB

Download
memory/1744-6-0x0000000000370000-0x0000000000372000-memory.dmp

Filesize
8KB

Download
memory/1744-7-0x0000000000370000-0x0000000000372000-memory.dmp

Filesize
8KB

Download
memory/1744-8-0x0000000000370000-0x0000000000372000-memory.dmp

Filesize
8KB

Download
memory/1744-9-0x0000000000370000-0x0000000000372000-memory.dmp

Filesize
8KB

Download
memory/1744-10-0x0000000000370000-0x0000000000372000-memory.dmp

Filesize
8KB

Download
memory/1744-11-0x0000000000370000-0x0000000000372000-memory.dmp

Filesize
8KB

Download
memory/1744-12-0x0000000000370000-0x0000000000372000-memory.dmp

Filesize
8KB

Download
memory/1744-13-0x0000000000370000-0x0000000000372000-memory.dmp

Filesize
8KB

Download
memory/1744-14-0x0000000000370000-0x0000000000372000-memory.dmp

Filesize
8KB

Download
memory/1744-15-0x0000000000370000-0x0000000000372000-memory.dmp

Filesize
8KB

Download
memory/1744-16-0x0000000000439000-0x000000000043A000-memory.dmp

Filesize
4KB

Download
memory/1744-17-0x0000000000390000-0x00000000003A0000-memory.dmp

Filesize
64KB

Download
memory/1744-21-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1744-22-0x0000000000390000-0x00000000003A0000-memory.dmp

Filesize
64KB

Download