Overview

overview

10

Static

static

3

2e4a386a2e...18.exe

windows7-x64

10

2e4a386a2e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2e4a386a2e326d511624691cfe4570e8_JaffaCakes118

  • Size

    292KB

  • Sample

    240510-kn5nfsgf38

  • MD5

    2e4a386a2e326d511624691cfe4570e8

  • SHA1

    915804059db6ac7b057d8ae959df557c522a6ec6

  • SHA256

    733529d501fc7e6aaa0252ac0d9f3dfcff9c1aab3047d9b2c706164b362f0b8a

  • SHA512

    e2102783a00cf56bbb8ac740fc6676b068be7b0b95a994923cfa8bb797a287ffc44f2c179c1cf0c53efd111ff354344bf54e35ae27ab437fc7bdf4be8ae41c37

  • SSDEEP

    3072:TyDDt+sqWE654G+COT7xNyH0kS0Vzw/BlC5Igu86XBfL3BEcB4K5QvvQ2Uzai:wt+bYHnOT9hX0VEAIgu8m52Mx5QvM

Score
10/10
emotetepoch3bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

190.192.39.136:80

5.189.168.53:8080

162.241.41.111:7080

190.85.46.52:7080

190.190.15.20:80

181.95.133.104:80

41.212.89.128:80

115.176.16.221:80

143.95.101.72:8080

75.127.14.170:8080

116.202.10.123:8080

74.208.173.91:8080

103.93.220.182:80

50.116.78.109:8080

67.121.104.51:20

180.26.62.115:443

139.59.12.63:8080

76.18.16.210:80

113.161.148.81:80

5.79.70.250:8080
rsa_pubkey.plain

Targets

    • Target

      2e4a386a2e326d511624691cfe4570e8_JaffaCakes118

    • Size

      292KB

    • MD5

      2e4a386a2e326d511624691cfe4570e8

    • SHA1

      915804059db6ac7b057d8ae959df557c522a6ec6

    • SHA256

      733529d501fc7e6aaa0252ac0d9f3dfcff9c1aab3047d9b2c706164b362f0b8a

    • SHA512

      e2102783a00cf56bbb8ac740fc6676b068be7b0b95a994923cfa8bb797a287ffc44f2c179c1cf0c53efd111ff354344bf54e35ae27ab437fc7bdf4be8ae41c37

    • SSDEEP

      3072:TyDDt+sqWE654G+COT7xNyH0kS0Vzw/BlC5Igu86XBfL3BEcB4K5QvvQ2Uzai:wt+bYHnOT9hX0VEAIgu8m52Mx5QvM

    Score
    10/10
    emotetepoch3bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet payload

      Detects Emotet payload in memory.

      trojanbanker

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks