emotet | aef15cb2d8a55d05eaad934ed73489e6411562f279efeaf604fb63fc2b957c6a

General

Target
1880a72494233fc8cf703e4083d88444_JaffaCakes118.exe
Size 532KB
Sample240505-t5b7xafa2w
SHA256 aef15cb2d8a55d05eaad934ed73489e6411562f279efeaf604fb63fc2b957c6a
MD5 1880a72494233fc8cf703e4083d88444
SHA1 b60166a5ecc885bfb5499703f10a8ffe02330ef7
SHA512 f01a70ed0d02b99dadf3c658678aafc19acc894c2a454a3df426222b9a59d5d99f3fbf09dacebe4d7f653daa3025ef3cdc18176c784bac0e368fd026aae833e1
SSDEEP 6144:1i3lLwdGzHnKSl+hwWu2e8ODcJ0Lv3paCgvgMdyv:1ewYzHKSRWdefDceId
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

94.205.247.10:80
86.22.221.170:80
85.25.255.207:8080
185.94.252.13:443
94.177.216.217:8080
186.4.172.5:20
198.199.114.69:8080
45.33.49.124:443
200.71.148.138:8080
24.45.195.162:7080
136.243.177.26:8080
95.128.43.213:8080
182.176.132.213:8090
190.228.72.244:53
152.89.236.214:8080
27.4.80.183:443
78.24.219.147:8080
62.75.187.192:8080
67.225.229.55:8080
83.136.245.190:8080
115.78.95.230:443
201.251.43.69:8080
86.98.25.30:53
47.41.213.2:22
211.63.71.72:8080
138.201.140.110:8080
200.113.106.18:21
181.143.194.138:443
27.147.163.188:8080
181.143.53.227:21
46.105.131.87:80
31.12.67.62:7080
173.212.203.26:8080
169.239.182.217:8080
159.65.25.128:8080
80.11.163.139:21
167.71.10.37:8080
103.39.131.88:80
186.4.172.5:443
192.81.213.192:8080
185.187.198.15:80
104.131.11.150:8080
80.11.163.139:443
31.172.240.91:8080
189.209.217.49:80
124.240.198.66:80
37.157.194.134:443
5.196.74.210:8080
133.167.80.63:7080
190.145.67.134:8090
206.189.98.125:8080
87.106.136.232:8080
87.106.139.101:8080
87.230.19.21:8080
190.226.44.20:21
182.76.6.2:8080
92.233.128.13:143
186.4.172.5:8080
85.54.169.141:8080
144.139.247.220:80
190.211.207.11:443
222.214.218.192:8080
85.104.59.244:20
178.79.161.166:443
186.176.138.171:7080
200.113.106.18:465
149.202.153.252:8080
200.51.94.251:80
92.222.216.44:8080
94.192.225.46:80
190.53.135.159:21
104.131.44.150:8080
162.241.208.52:8080
104.236.246.93:8080
212.71.234.16:8080
59.103.164.174:80
187.144.61.73:443
217.160.182.191:8080
91.205.215.66:8080
186.75.241.230:80
69.164.201.54:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	pagesddl.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	pagesddl.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	pagesddl.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	pagesddl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	pagesddl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	pagesddl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	pagesddl.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4468	pagesddl.exe
4468	pagesddl.exe
4468	pagesddl.exe
4468	pagesddl.exe
4468	pagesddl.exe
4468	pagesddl.exe
4468	pagesddl.exe
4468	pagesddl.exe
4468	pagesddl.exe
4468	pagesddl.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3920	1880a72494233fc8cf703e4083d88444_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1508	1880a72494233fc8cf703e4083d88444_JaffaCakes118.exe
1508	1880a72494233fc8cf703e4083d88444_JaffaCakes118.exe
3920	1880a72494233fc8cf703e4083d88444_JaffaCakes118.exe
3920	1880a72494233fc8cf703e4083d88444_JaffaCakes118.exe
368	pagesddl.exe
368	pagesddl.exe
4468	pagesddl.exe
4468	pagesddl.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 3920	1508	1880a72494233fc8cf703e4083d88444_JaffaCakes118.exe	87
PID 1508 wrote to memory of 3920	1508	1880a72494233fc8cf703e4083d88444_JaffaCakes118.exe	87
PID 1508 wrote to memory of 3920	1508	1880a72494233fc8cf703e4083d88444_JaffaCakes118.exe	87
PID 368 wrote to memory of 4468	368	pagesddl.exe	98
PID 368 wrote to memory of 4468	368	pagesddl.exe	98
PID 368 wrote to memory of 4468	368	pagesddl.exe	98

C:\Users\Admin\AppData\Local\Temp\1880a72494233fc8cf703e4083d88444_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1880a72494233fc8cf703e4083d88444_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Users\Admin\AppData\Local\Temp\1880a72494233fc8cf703e4083d88444_JaffaCakes118.exe
  --1f92175c
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  PID:3920

C:\Windows\SysWOW64\pagesddl.exe
"C:\Windows\SysWOW64\pagesddl.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\SysWOW64\pagesddl.exe
  --dfbf157a
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/368-11-0x0000000000F40000-0x0000000000F54000-memory.dmp

Download

memory/1508-0-0x00000000022B0000-0x00000000022C4000-memory.dmp

Download

memory/1508-5-0x0000000002200000-0x000000000220F000-memory.dmp

Download

memory/3920-6-0x0000000002250000-0x0000000002264000-memory.dmp

Download

memory/3920-16-0x0000000000400000-0x0000000000489000-memory.dmp

Download

memory/4468-17-0x0000000000D80000-0x0000000000D94000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads