emotet | c0292f976bda52714f6b2f9d7c7a36ad351c5c38a99bfe7599da471e5168295b

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
26-06-2024 23:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13ef12fa3d06f6dc4307eb4b412601af_JaffaCakes118.dll
Size

340KB
MD5

13ef12fa3d06f6dc4307eb4b412601af
SHA1

0605486b7bfd9832f04e89c22acfe5951ea98214
SHA256

c0292f976bda52714f6b2f9d7c7a36ad351c5c38a99bfe7599da471e5168295b
SHA512

c3d2756a54b481e1328a5bf3f72a22df9e847aa6d524190b4f58b7539cb94581fa14781de36c8420dc1f9cda89eb7cb6ed4fb3f49526db4e4a45c873183acc37
SSDEEP

3072:WvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:W206xWgGxLxWN40PDKR/JnX2P

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

69.38.130.14:80

195.159.28.230:8080

162.241.204.233:8080

115.21.224.117:80

78.189.148.42:80

181.165.68.127:80

78.188.225.105:80

161.0.153.60:80

89.106.251.163:80

172.125.40.123:80

5.39.91.110:7080

110.145.11.73:80

190.251.200.206:80

144.217.7.207:7080

75.109.111.18:80

75.177.207.146:80

139.59.60.244:8080

70.183.211.3:80

95.213.236.64:8080

61.19.246.238:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

3 2040 rundll32.exe
7 2040 rundll32.exe
8 2040 rundll32.exe
9 2040 rundll32.exe
12 2040 rundll32.exe
13 2040 rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

2040 rundll32.exe
2040 rundll32.exe
2040 rundll32.exe
2040 rundll32.exe

flow	pid	process
3	2040	rundll32.exe
7	2040	rundll32.exe
8	2040	rundll32.exe
9	2040	rundll32.exe
12	2040	rundll32.exe
13	2040	rundll32.exe

pid	process
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe
2040	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2220 wrote to memory of 2040	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2040	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2040	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2040	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2040	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2040	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2040	2220	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13ef12fa3d06f6dc4307eb4b412601af_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13ef12fa3d06f6dc4307eb4b412601af_JaffaCakes118.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-0-0x00000000001A0000-0x00000000001C0000-memory.dmp

Filesize
128KB

Download
memory/2040-1-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/2040-2-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/2040-3-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download