emotet | 1e8161875d16cb858c1262233aa7be1d54276644c28d6963cf7116907481a793

General

Target

2127937008c1d07502ae039dc56b79b4_JaffaCakes118.exe
Size

258KB
MD5

2127937008c1d07502ae039dc56b79b4
SHA1

c529479b9e9e77c43addb89266182c79ac23a731
SHA256

1e8161875d16cb858c1262233aa7be1d54276644c28d6963cf7116907481a793
SHA512

815eff2f71ff30a1ef025c126302cdbc9bd261f834b1fb88b4d4cac34e09aac3adad4b74cbd4aba5b091151c64649fd8a94ecca2aa21e35108d16de0c9566e9b
SSDEEP

6144:eOvjHC4lzb94HfwRG9eqoZTCpy539NRvxg3cayb6GpWFp:vjHC4lzb94HfCXoMx5vxwrygFp

Score

10^/10

emotet epoch3 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

181.198.203.45:443

70.45.30.28:80

211.110.229.161:443

193.34.144.138:8080

74.208.173.91:8080

154.120.227.206:8080

124.150.175.133:80

192.163.221.191:8080

95.216.207.86:7080

142.93.87.198:8080

216.75.37.196:8080

181.47.235.26:993

198.57.217.170:8080

176.58.93.123:80

94.177.253.126:80

83.169.33.157:8080

186.18.224.149:80

157.7.164.178:8081

192.241.220.183:8080

216.70.88.55:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	ctntmedium.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 25 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-d9-37-fd-29-2d\WpadDecisionReason = "1"	ctntmedium.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-d9-37-fd-29-2d\WpadDecisionTime = a0354020a2a0da01	ctntmedium.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-d9-37-fd-29-2d\WpadDecisionTime = 8024365ba2a0da01	ctntmedium.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	ctntmedium.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{30D50AEC-DD7D-4392-ACA3-54FA2CB9F4B9}\WpadDecisionReason = "1"	ctntmedium.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{30D50AEC-DD7D-4392-ACA3-54FA2CB9F4B9}\WpadDecision = "0"	ctntmedium.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{30D50AEC-DD7D-4392-ACA3-54FA2CB9F4B9}	ctntmedium.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-d9-37-fd-29-2d\WpadDetectedUrl	ctntmedium.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ctntmedium.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ctntmedium.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	ctntmedium.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{30D50AEC-DD7D-4392-ACA3-54FA2CB9F4B9}\WpadNetworkName = "Network 3"	ctntmedium.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-d9-37-fd-29-2d	ctntmedium.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{30D50AEC-DD7D-4392-ACA3-54FA2CB9F4B9}\9a-d9-37-fd-29-2d	ctntmedium.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ctntmedium.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	ctntmedium.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f012c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ctntmedium.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-d9-37-fd-29-2d\WpadDecision = "0"	ctntmedium.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f012c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ctntmedium.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{30D50AEC-DD7D-4392-ACA3-54FA2CB9F4B9}\WpadDecisionTime = 8024365ba2a0da01	ctntmedium.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	ctntmedium.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{30D50AEC-DD7D-4392-ACA3-54FA2CB9F4B9}\WpadDecisionTime = a0354020a2a0da01	ctntmedium.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	ctntmedium.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ctntmedium.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	ctntmedium.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2604	ctntmedium.exe
2604	ctntmedium.exe
2604	ctntmedium.exe
2604	ctntmedium.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
620	2127937008c1d07502ae039dc56b79b4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 620	2208	2127937008c1d07502ae039dc56b79b4_JaffaCakes118.exe	28
PID 2208 wrote to memory of 620	2208	2127937008c1d07502ae039dc56b79b4_JaffaCakes118.exe	28
PID 2208 wrote to memory of 620	2208	2127937008c1d07502ae039dc56b79b4_JaffaCakes118.exe	28
PID 2208 wrote to memory of 620	2208	2127937008c1d07502ae039dc56b79b4_JaffaCakes118.exe	28
PID 2536 wrote to memory of 2604	2536	ctntmedium.exe	30
PID 2536 wrote to memory of 2604	2536	ctntmedium.exe	30
PID 2536 wrote to memory of 2604	2536	ctntmedium.exe	30
PID 2536 wrote to memory of 2604	2536	ctntmedium.exe	30

C:\Users\Admin\AppData\Local\Temp\2127937008c1d07502ae039dc56b79b4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2127937008c1d07502ae039dc56b79b4_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Users\Admin\AppData\Local\Temp\2127937008c1d07502ae039dc56b79b4_JaffaCakes118.exe
  --72441329
  2⤵
  - Suspicious behavior: RenamesItself
  PID:620

C:\Windows\SysWOW64\ctntmedium.exe
"C:\Windows\SysWOW64\ctntmedium.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\ctntmedium.exe
  --3ba77f5e
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/620-18-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2208-0-0x0000000000260000-0x0000000000277000-memory.dmp

Filesize
92KB

Download
memory/2208-5-0x0000000000240000-0x0000000000251000-memory.dmp

Filesize
68KB

Download
memory/2208-6-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2536-12-0x00000000005E0000-0x00000000005F7000-memory.dmp

Filesize
92KB

Download
memory/2536-17-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2604-19-0x00000000002B0000-0x00000000002C7000-memory.dmp

Filesize
92KB

Download
memory/2604-24-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing