emotet | 65c7fb4891c1158fa591e11d37007d707eea5f092001e29b4660f5e8a72cb8d7

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1853aa2b0abfa4fe5bb35f016dc0d3ca_JaffaCakes118.dll
Size

346KB
MD5

1853aa2b0abfa4fe5bb35f016dc0d3ca
SHA1

5ee8ba30e29f4aaa36831f4bc4c600e53afbda85
SHA256

65c7fb4891c1158fa591e11d37007d707eea5f092001e29b4660f5e8a72cb8d7
SHA512

885639054c2c94fea7ce14b5fade2ff37eb9e6ac137caa2ba3d231dcd882ddf03604014e808c4107e17d7a22816345fe77a213bd59707b37a77e6f8d9d150a00
SSDEEP

3072:082jpiC2JG7HZb7XWQml/jz8A4diTE90Q6kF4CKAYRkcj:v2L7HN7Kl/jLA90QECrYRpj

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

84.232.229.24:80

51.255.203.164:8080

217.160.169.110:8080

51.15.7.145:80

177.85.167.10:80

186.177.174.163:80

190.114.254.163:8080

185.183.16.47:80

149.202.72.142:7080

181.30.61.163:443

31.27.59.105:80

50.28.51.143:8080

68.183.190.199:8080

85.214.26.7:8080

137.74.106.111:7080

200.75.39.254:80

85.105.239.184:443

190.45.24.210:80

170.81.48.2:80

109.101.137.162:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

40 4648 rundll32.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exe

pid process

4648 rundll32.exe
4648 rundll32.exe
4648 rundll32.exe
4648 rundll32.exe

flow	pid	process
40	4648	rundll32.exe

pid	process
4648	rundll32.exe
4648	rundll32.exe
4648	rundll32.exe
4648	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3660 wrote to memory of 4648	3660	rundll32.exe	rundll32.exe
PID 3660 wrote to memory of 4648	3660	rundll32.exe	rundll32.exe
PID 3660 wrote to memory of 4648	3660	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1853aa2b0abfa4fe5bb35f016dc0d3ca_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3660

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1853aa2b0abfa4fe5bb35f016dc0d3ca_JaffaCakes118.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4648-0-0x0000000000AD0000-0x0000000000AF1000-memory.dmp

Filesize
132KB

Download
memory/4648-1-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/4648-2-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download