emotet | c71f65bc6a95dedd71b2639da85e05c829f6c089c611a5e12c8453e46d5e19c5

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 15:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

167ab011f9c47bb116e5159ded5722f0_JaffaCakes118.dll
Size

340KB
MD5

167ab011f9c47bb116e5159ded5722f0
SHA1

e56f7791ee382dd187679790d4d46ea5d6e7f8e6
SHA256

c71f65bc6a95dedd71b2639da85e05c829f6c089c611a5e12c8453e46d5e19c5
SHA512

67e5f769abc57547e4d2ad5a04cb397efccfe95177687fc9892475fe87ab8c64a5d9813783eabcdc1d7642a1eaf2c6d4eff3c89785e3d6c0541aaad329b6403b
SSDEEP

3072:UvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXRca:U206xWgGxLxWN40PDKR/JnXya

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

69.38.130.14:80

195.159.28.230:8080

162.241.204.233:8080

115.21.224.117:80

78.189.148.42:80

181.165.68.127:80

78.188.225.105:80

161.0.153.60:80

89.106.251.163:80

172.125.40.123:80

5.39.91.110:7080

110.145.11.73:80

190.251.200.206:80

144.217.7.207:7080

75.109.111.18:80

75.177.207.146:80

139.59.60.244:8080

70.183.211.3:80

95.213.236.64:8080

61.19.246.238:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

3 1984 rundll32.exe
5 1984 rundll32.exe
6 1984 rundll32.exe
7 1984 rundll32.exe
8 1984 rundll32.exe
9 1984 rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

1984 rundll32.exe
1984 rundll32.exe
1984 rundll32.exe
1984 rundll32.exe

flow	pid	process
3	1984	rundll32.exe
5	1984	rundll32.exe
6	1984	rundll32.exe
7	1984	rundll32.exe
8	1984	rundll32.exe
9	1984	rundll32.exe

pid	process
1984	rundll32.exe
1984	rundll32.exe
1984	rundll32.exe
1984	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2340 wrote to memory of 1984	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 1984	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 1984	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 1984	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 1984	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 1984	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 1984	2340	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\167ab011f9c47bb116e5159ded5722f0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\167ab011f9c47bb116e5159ded5722f0_JaffaCakes118.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1984-0-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/1984-1-0x00000000001C0000-0x00000000001E0000-memory.dmp

Filesize
128KB

Download
memory/1984-2-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/1984-3-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download