emotet | 552c9e0347c2cf81591ffbc2e7a43d9e8b1cd4077c8ed1475edd3dab8c40a15d

Analysis

max time kernel
139s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29-04-2024 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

079ca6d6a46a700b7d116d934e770a7c_JaffaCakes118.exe
Size

176KB
MD5

079ca6d6a46a700b7d116d934e770a7c
SHA1

7acfc4e7a4ec0efefebd7a07b10e7b1ab9acabe8
SHA256

552c9e0347c2cf81591ffbc2e7a43d9e8b1cd4077c8ed1475edd3dab8c40a15d
SHA512

29b09677696724d9a4fed991ef782cb50e1839b3b0fbc327cb47a8321e436631f9bb1b592249354b233b5766fb74a895beae320cb7a8f979e9177411ae901f01
SSDEEP

3072:YYYjSRIL9C/sjzaWhT+F2TpIJRkEaGTBvSWAQEvOQ1:YYY2RIL8/ET+kT8Rb0o

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

75.80.124.4:80

134.209.36.254:8080

104.156.59.7:8080

120.138.30.150:8080

107.5.122.110:80

195.251.213.56:80

91.211.88.52:7080

79.98.24.39:8080

75.139.38.211:80

82.225.49.121:80

162.241.242.173:8080

94.1.108.190:443

85.105.205.77:8080

181.169.34.190:80

24.179.13.119:80

139.59.67.118:443

82.80.155.43:80

50.91.114.38:80

93.147.212.206:80

153.232.188.106:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet payload 5 IoCs

Detects Emotet payload in memory.

trojan banker

Processes:

resource	yara_rule
behavioral2/memory/224-4-0x0000000000A70000-0x0000000000A80000-memory.dmp	emotet
behavioral2/memory/224-0-0x0000000002250000-0x0000000002262000-memory.dmp	emotet
behavioral2/memory/224-7-0x00000000005D0000-0x00000000005DF000-memory.dmp	emotet
behavioral2/memory/5108-14-0x0000000002380000-0x0000000002390000-memory.dmp	emotet
behavioral2/memory/5108-10-0x0000000002360000-0x0000000002372000-memory.dmp	emotet

Executes dropped EXE 1 IoCs

Processes:

srmclient.exe

pid process

5108 srmclient.exe
Drops file in System32 directory 1 IoCs

Processes:

079ca6d6a46a700b7d116d934e770a7c_JaffaCakes118.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\loadperf\srmclient.exe 079ca6d6a46a700b7d116d934e770a7c_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\loadperf\srmclient.exe	079ca6d6a46a700b7d116d934e770a7c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

srmclient.exe

pid	process
5108	srmclient.exe
5108	srmclient.exe
5108	srmclient.exe
5108	srmclient.exe
5108	srmclient.exe
5108	srmclient.exe
5108	srmclient.exe
5108	srmclient.exe
5108	srmclient.exe
5108	srmclient.exe
5108	srmclient.exe
5108	srmclient.exe
5108	srmclient.exe
5108	srmclient.exe
5108	srmclient.exe
5108	srmclient.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

079ca6d6a46a700b7d116d934e770a7c_JaffaCakes118.exe

pid process

224 079ca6d6a46a700b7d116d934e770a7c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

079ca6d6a46a700b7d116d934e770a7c_JaffaCakes118.exesrmclient.exe

pid	process
224	079ca6d6a46a700b7d116d934e770a7c_JaffaCakes118.exe
224	079ca6d6a46a700b7d116d934e770a7c_JaffaCakes118.exe
5108	srmclient.exe
5108	srmclient.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

079ca6d6a46a700b7d116d934e770a7c_JaffaCakes118.exe

description	pid	process	target process
PID 224 wrote to memory of 5108	224	079ca6d6a46a700b7d116d934e770a7c_JaffaCakes118.exe	srmclient.exe
PID 224 wrote to memory of 5108	224	079ca6d6a46a700b7d116d934e770a7c_JaffaCakes118.exe	srmclient.exe
PID 224 wrote to memory of 5108	224	079ca6d6a46a700b7d116d934e770a7c_JaffaCakes118.exe	srmclient.exe

C:\Users\Admin\AppData\Local\Temp\079ca6d6a46a700b7d116d934e770a7c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\079ca6d6a46a700b7d116d934e770a7c_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:224

C:\Windows\SysWOW64\loadperf\srmclient.exe
"C:\Windows\SysWOW64\loadperf\srmclient.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5108

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\loadperf\srmclient.exe
Filesize
176KB

MD5
079ca6d6a46a700b7d116d934e770a7c

SHA1
7acfc4e7a4ec0efefebd7a07b10e7b1ab9acabe8

SHA256
552c9e0347c2cf81591ffbc2e7a43d9e8b1cd4077c8ed1475edd3dab8c40a15d

SHA512
29b09677696724d9a4fed991ef782cb50e1839b3b0fbc327cb47a8321e436631f9bb1b592249354b233b5766fb74a895beae320cb7a8f979e9177411ae901f01

Download Submit
memory/224-4-0x0000000000A70000-0x0000000000A80000-memory.dmp

Filesize
64KB

Download
memory/224-0-0x0000000002250000-0x0000000002262000-memory.dmp

Filesize
72KB

Download
memory/224-7-0x00000000005D0000-0x00000000005DF000-memory.dmp

Filesize
60KB

Download
memory/224-9-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/5108-14-0x0000000002380000-0x0000000002390000-memory.dmp

Filesize
64KB

Download
memory/5108-10-0x0000000002360000-0x0000000002372000-memory.dmp

Filesize
72KB

Download