emotet | ba7dec4f8276e3d3f7f4ea65bd2da7fe70b0d74de369e282f541c1f2db33bed9

General

Target
333222279ebb1c9eb509df6d8c43c11c_JaffaCakes118.exe
Size 532KB
Sample240511-g67c8aad7y
SHA256 ba7dec4f8276e3d3f7f4ea65bd2da7fe70b0d74de369e282f541c1f2db33bed9
MD5 333222279ebb1c9eb509df6d8c43c11c
SHA1 2dfa2185ae9d245e2277086b59c27776987e348f
SHA512 1cd36ad3ffebfc9eac21b53cf74d82070afa4f3a55dbbea930caab6d60eacc0f6b77551bfcac8876501bc1ce583569bd36b73b00ec80a873d907fa987987841d
SSDEEP 12288:MKAwN26MSnj2MTVF+N5gyJx+D9eljYcwAC/PR2nsJkLL:rJjRSN89elj01PRNJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

186.4.172.5:443
186.4.172.5:8080
85.25.255.207:8080
185.94.252.13:443
94.177.216.217:8080
124.240.198.66:80
189.209.217.49:80
200.113.106.18:465
200.113.106.18:21
185.187.198.15:80
159.65.25.128:8080
87.106.136.232:8080
83.136.245.190:8080
212.71.234.16:8080
103.39.131.88:80
169.239.182.217:8080
136.243.177.26:8080
167.71.10.37:8080
201.250.54.115:50000
190.226.44.20:21
152.89.236.214:8080
206.189.98.125:8080
94.192.225.46:80
94.205.247.10:80
190.211.207.11:443
5.196.74.210:8080
182.76.6.2:8080
80.11.163.139:443
200.71.148.138:8080
192.81.213.192:8080
87.230.19.21:8080
69.164.201.54:8080
133.167.80.63:7080
37.157.194.134:443
201.251.43.69:8080
182.176.132.213:8090
115.78.95.230:443
59.103.164.174:80
86.22.221.170:80
217.160.182.191:8080
190.228.72.244:53
198.199.114.69:8080
186.4.172.5:20
104.131.11.150:8080
104.236.246.93:8080
80.11.163.139:21
178.210.51.222:8080
91.205.215.66:8080
190.145.67.134:8090
47.41.213.2:22
173.212.203.26:8080
181.143.194.138:443
200.51.94.251:80
138.201.140.110:8080
162.241.208.52:8080
31.12.67.62:7080
144.139.247.220:80
104.131.44.150:8080
186.176.138.171:7080
178.79.161.166:443
67.225.229.55:8080
85.104.59.244:20
222.214.218.192:8080
181.143.53.227:21
24.45.195.162:7080
87.106.139.101:8080
92.222.216.44:8080
86.98.25.30:53
186.75.241.230:80
45.33.49.124:443
149.202.153.252:8080
92.233.128.13:143
46.105.131.87:80
85.54.169.141:8080
27.147.163.188:8080
62.75.187.192:8080
211.63.71.72:8080
95.128.43.213:8080
31.172.240.91:8080
190.53.135.159:21
78.24.219.147:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	mobsynctypeb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	mobsynctypeb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	mobsynctypeb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	mobsynctypeb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mobsynctypeb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mobsynctypeb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mobsynctypeb.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2988	mobsynctypeb.exe
2988	mobsynctypeb.exe
2988	mobsynctypeb.exe
2988	mobsynctypeb.exe
2988	mobsynctypeb.exe
2988	mobsynctypeb.exe
2988	mobsynctypeb.exe
2988	mobsynctypeb.exe
2988	mobsynctypeb.exe
2988	mobsynctypeb.exe
2988	mobsynctypeb.exe
2988	mobsynctypeb.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3132	333222279ebb1c9eb509df6d8c43c11c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3812	333222279ebb1c9eb509df6d8c43c11c_JaffaCakes118.exe
3812	333222279ebb1c9eb509df6d8c43c11c_JaffaCakes118.exe
3132	333222279ebb1c9eb509df6d8c43c11c_JaffaCakes118.exe
3132	333222279ebb1c9eb509df6d8c43c11c_JaffaCakes118.exe
4208	mobsynctypeb.exe
4208	mobsynctypeb.exe
2988	mobsynctypeb.exe
2988	mobsynctypeb.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 3132	3812	333222279ebb1c9eb509df6d8c43c11c_JaffaCakes118.exe	81
PID 3812 wrote to memory of 3132	3812	333222279ebb1c9eb509df6d8c43c11c_JaffaCakes118.exe	81
PID 3812 wrote to memory of 3132	3812	333222279ebb1c9eb509df6d8c43c11c_JaffaCakes118.exe	81
PID 4208 wrote to memory of 2988	4208	mobsynctypeb.exe	83
PID 4208 wrote to memory of 2988	4208	mobsynctypeb.exe	83
PID 4208 wrote to memory of 2988	4208	mobsynctypeb.exe	83

C:\Users\Admin\AppData\Local\Temp\333222279ebb1c9eb509df6d8c43c11c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\333222279ebb1c9eb509df6d8c43c11c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Users\Admin\AppData\Local\Temp\333222279ebb1c9eb509df6d8c43c11c_JaffaCakes118.exe
  --e4a9cc10
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  PID:3132

C:\Windows\SysWOW64\mobsynctypeb.exe
"C:\Windows\SysWOW64\mobsynctypeb.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\SysWOW64\mobsynctypeb.exe
  --8797b65f
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2988-17-0x0000000000F50000-0x0000000000F64000-memory.dmp

Download

memory/3132-6-0x0000000000740000-0x0000000000754000-memory.dmp

Download

memory/3132-16-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3812-0-0x0000000002160000-0x0000000002174000-memory.dmp

Download

memory/3812-5-0x0000000002150000-0x000000000215F000-memory.dmp

Download

memory/4208-11-0x0000000000F80000-0x0000000000F94000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads