emotet | b90c134581642a96f7f6be1b7a8ac33df7f92eb9e5149f81583eaff702906ece

Analysis

max time kernel
129s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 04:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02758b67b14376513986057a4220046f_JaffaCakes118.exe
Size

448KB
MD5

02758b67b14376513986057a4220046f
SHA1

1aa0a070621d544d4d98795d96c2121ced23f475
SHA256

b90c134581642a96f7f6be1b7a8ac33df7f92eb9e5149f81583eaff702906ece
SHA512

be3901b1870a7a53ecff0c85f13ef7b06feb6f2c6921c727c78e90fa7b3f1b0ebe90e23c07d42d38d4657d61732f74e8f69d5c8fb034dd1c6f13434058528a92
SSDEEP

12288:EfzaBuiszJbE9mO4sl9kHAOyQkNvOzxr:EbMmO4sl9gR2Ot

Score

10^/10

emotet epoch3 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

71.57.180.213:80

185.86.148.68:443

168.235.82.183:8080

181.113.229.139:443

181.134.9.162:80

217.199.160.224:8080

105.209.235.113:8080

216.75.37.196:8080

97.104.107.190:80

203.153.216.182:7080

107.161.30.122:8080

41.106.96.12:80

202.5.47.71:80

201.235.10.215:80

105.213.67.88:80

115.79.195.246:80

179.5.118.12:80

212.112.113.235:80

139.59.12.63:8080

177.37.81.212:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet payload 4 IoCs

Detects Emotet payload in memory.

trojan banker

resource	yara_rule
behavioral2/memory/4756-0-0x0000000002140000-0x000000000214C000-memory.dmp	emotet
behavioral2/memory/4756-4-0x0000000002130000-0x0000000002139000-memory.dmp	emotet
behavioral2/memory/1416-7-0x0000000002710000-0x000000000271C000-memory.dmp	emotet
behavioral2/memory/1416-11-0x0000000002710000-0x000000000271C000-memory.dmp	emotet

Executes dropped EXE 1 IoCs

pid	Process
1416	msjtes40.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dssec\msjtes40.exe	02758b67b14376513986057a4220046f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1416	msjtes40.exe
1416	msjtes40.exe
1416	msjtes40.exe
1416	msjtes40.exe
1416	msjtes40.exe
1416	msjtes40.exe
1416	msjtes40.exe
1416	msjtes40.exe
1416	msjtes40.exe
1416	msjtes40.exe
1416	msjtes40.exe
1416	msjtes40.exe
1416	msjtes40.exe
1416	msjtes40.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4756	02758b67b14376513986057a4220046f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4756	02758b67b14376513986057a4220046f_JaffaCakes118.exe
4756	02758b67b14376513986057a4220046f_JaffaCakes118.exe
1416	msjtes40.exe
1416	msjtes40.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 1416	4756	02758b67b14376513986057a4220046f_JaffaCakes118.exe	83
PID 4756 wrote to memory of 1416	4756	02758b67b14376513986057a4220046f_JaffaCakes118.exe	83
PID 4756 wrote to memory of 1416	4756	02758b67b14376513986057a4220046f_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\02758b67b14376513986057a4220046f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02758b67b14376513986057a4220046f_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\SysWOW64\dssec\msjtes40.exe
  "C:\Windows\SysWOW64\dssec\msjtes40.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\dssec\msjtes40.exe

Filesize
448KB

MD5
02758b67b14376513986057a4220046f

SHA1
1aa0a070621d544d4d98795d96c2121ced23f475

SHA256
b90c134581642a96f7f6be1b7a8ac33df7f92eb9e5149f81583eaff702906ece

SHA512
be3901b1870a7a53ecff0c85f13ef7b06feb6f2c6921c727c78e90fa7b3f1b0ebe90e23c07d42d38d4657d61732f74e8f69d5c8fb034dd1c6f13434058528a92

Download Submit
memory/1416-7-0x0000000002710000-0x000000000271C000-memory.dmp

Filesize
48KB

Download
memory/1416-11-0x0000000002710000-0x000000000271C000-memory.dmp

Filesize
48KB

Download
memory/4756-0-0x0000000002140000-0x000000000214C000-memory.dmp

Filesize
48KB

Download
memory/4756-4-0x0000000002130000-0x0000000002139000-memory.dmp

Filesize
36KB

Download
memory/4756-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download