emotet | 031ce41f0a8fafa238a9731fb77f9c0bbb9fa18102ab7553aeb237d0231e755e

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 11:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15e6098b4e5d66bddcc19ae5f4dc7fae_JaffaCakes118.dll
Size

340KB
MD5

15e6098b4e5d66bddcc19ae5f4dc7fae
SHA1

b0f70fbd7edbd4d1223bc6de5cbc6c7d76603afa
SHA256

031ce41f0a8fafa238a9731fb77f9c0bbb9fa18102ab7553aeb237d0231e755e
SHA512

106cfcfbc7aeb604935a8ce52e5a83a0aa3f5502fcd1dd8be1e59de13cb1756c18dc6af037bea329f80c321ee8e7b6febee0dd2587ab53f96eb7c0fb53bc74cd
SSDEEP

3072:MvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:M206xWgGxLxWN40PDKR/JnX2P

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

69.38.130.14:80

195.159.28.230:8080

162.241.204.233:8080

115.21.224.117:80

78.189.148.42:80

181.165.68.127:80

78.188.225.105:80

161.0.153.60:80

89.106.251.163:80

172.125.40.123:80

5.39.91.110:7080

110.145.11.73:80

190.251.200.206:80

144.217.7.207:7080

75.109.111.18:80

75.177.207.146:80

139.59.60.244:8080

70.183.211.3:80

95.213.236.64:8080

61.19.246.238:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 7 IoCs

Processes:

rundll32.exe

flow pid process

3 1660 rundll32.exe
5 1660 rundll32.exe
6 1660 rundll32.exe
7 1660 rundll32.exe
8 1660 rundll32.exe
9 1660 rundll32.exe
11 1660 rundll32.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

rundll32.exe

pid process

1660 rundll32.exe
1660 rundll32.exe
1660 rundll32.exe
1660 rundll32.exe
1660 rundll32.exe

flow	pid	process
3	1660	rundll32.exe
5	1660	rundll32.exe
6	1660	rundll32.exe
7	1660	rundll32.exe
8	1660	rundll32.exe
9	1660	rundll32.exe
11	1660	rundll32.exe

pid	process
1660	rundll32.exe
1660	rundll32.exe
1660	rundll32.exe
1660	rundll32.exe
1660	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2204 wrote to memory of 1660	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 1660	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 1660	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 1660	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 1660	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 1660	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 1660	2204	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\15e6098b4e5d66bddcc19ae5f4dc7fae_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\15e6098b4e5d66bddcc19ae5f4dc7fae_JaffaCakes118.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1660-1-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/1660-0-0x0000000000180000-0x00000000001A0000-memory.dmp

Filesize
128KB

Download
memory/1660-2-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/1660-3-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download