emotet | 579064ed7a035e9d72373c8d407a828ea5eb6ee3b94c5a6b7d71fa51751a719c

General

Target
40aa7157bcec5676ad30cff554d6f209_JaffaCakes118.exe
Size 278KB
Sample240514-h7tdesfa21
SHA256 579064ed7a035e9d72373c8d407a828ea5eb6ee3b94c5a6b7d71fa51751a719c
MD5 40aa7157bcec5676ad30cff554d6f209
SHA1 1777ea03ed660853be9b671e469c3f514fa327c0
SHA512 e62d7695a8ca2fc5f2114d0814be131fbd072a384c971771ba9261c2844a4f920d56fa8a3d0c49aea17082cf5a40713d176f8a04ebfb3f1e1fe892f09a5b6a63
SSDEEP 6144:oqJs8euVV/Nsxp+IsUTNeY3hF879W15LlSB1I:ows8eOVl0pf87M1SBu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch3 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

192.161.190.171:8080
80.93.48.49:7080
83.169.33.157:8080
222.239.249.166:443
212.129.14.27:8080
143.95.101.72:8080
119.159.150.176:443
193.34.144.138:8080
95.216.212.157:8080
181.197.108.171:443
157.7.164.178:8081
50.116.78.109:8080
51.38.134.203:8080
23.253.207.142:8080
78.46.87.133:8080
95.216.207.86:7080
37.59.24.25:8080
177.226.25.78:80
5.189.148.98:8080
216.75.37.196:8080
190.189.79.73:80
186.66.224.182:990
91.205.173.54:8080
124.150.175.129:8080
192.241.220.183:8080
142.93.87.198:8080
200.71.112.158:53
181.47.235.26:993
192.163.221.191:8080
191.100.24.201:50000
124.150.175.133:80
162.144.46.90:8080
46.17.6.116:8080
46.105.131.68:8080
195.201.56.68:7080
195.226.144.249:80
212.112.113.235:80
181.44.166.242:80
198.57.217.170:8080
187.177.155.123:990
138.197.140.163:8080
201.196.15.79:990
163.172.97.112:8080
172.104.70.207:8080
139.162.185.116:443
113.52.135.33:7080
176.58.93.123:80
217.26.163.82:7080
172.245.13.50:8080
152.169.32.143:8080
182.176.116.139:995

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	acquiresmo.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	acquiresmo.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	acquiresmo.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	acquiresmo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	acquiresmo.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	acquiresmo.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	acquiresmo.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4520	acquiresmo.exe
4520	acquiresmo.exe
4520	acquiresmo.exe
4520	acquiresmo.exe
4520	acquiresmo.exe
4520	acquiresmo.exe
4520	acquiresmo.exe
4520	acquiresmo.exe
4520	acquiresmo.exe
4520	acquiresmo.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4840	40aa7157bcec5676ad30cff554d6f209_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 4840	4504	40aa7157bcec5676ad30cff554d6f209_JaffaCakes118.exe	83
PID 4504 wrote to memory of 4840	4504	40aa7157bcec5676ad30cff554d6f209_JaffaCakes118.exe	83
PID 4504 wrote to memory of 4840	4504	40aa7157bcec5676ad30cff554d6f209_JaffaCakes118.exe	83
PID 2176 wrote to memory of 4520	2176	acquiresmo.exe	96
PID 2176 wrote to memory of 4520	2176	acquiresmo.exe	96
PID 2176 wrote to memory of 4520	2176	acquiresmo.exe	96

C:\Users\Admin\AppData\Local\Temp\40aa7157bcec5676ad30cff554d6f209_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\40aa7157bcec5676ad30cff554d6f209_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Users\Admin\AppData\Local\Temp\40aa7157bcec5676ad30cff554d6f209_JaffaCakes118.exe
  --1cc398fb
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4840

C:\Windows\SysWOW64\acquiresmo.exe
"C:\Windows\SysWOW64\acquiresmo.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\acquiresmo.exe
  --19b12571
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5ee9f8cddb3ff188c6a99dcf99203008_41e50f4a-4a76-42e1-a3df-51306e426307

Path C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\5ee9f8cddb3ff188c6a99dcf99203008_41e50f4a-4a76-42e1-a3df-51306e426307
Size 50B
SHA256 d627b40c75603106e24782fdb852c180722ae6d472bdb60367bf2708f28f5454
MD5 aaec799e344163d0d188e0590697cb1e
SHA1 94aa3e9674f1335e1cdf6dc7b7c7cdbf5c97c65d
SHA512 285e78b5ddc3049b2b167e0c785f410260eecdbb745489e3e5984e118c627e97b7499f8a937a4a6d5da4fe046fb220fc70fd5abc583083909fd005b1ee4f03b0
MD5 SHA1 SHA512

Submit Download

memory/2176-13-0x0000000001930000-0x0000000001944000-memory.dmp

Download

memory/2176-18-0x0000000001910000-0x000000000191F000-memory.dmp

Download

memory/4504-0-0x0000000000C20000-0x0000000000C34000-memory.dmp

Download

memory/4504-5-0x0000000000BC0000-0x0000000000BCF000-memory.dmp

Download

memory/4520-21-0x0000000002230000-0x0000000002244000-memory.dmp

Download

memory/4520-26-0x0000000001830000-0x000000000183F000-memory.dmp

Download

memory/4840-10-0x0000000000C60000-0x0000000000C74000-memory.dmp

Download

memory/4840-11-0x0000000000C50000-0x0000000000C5F000-memory.dmp

Download

memory/4840-20-0x0000000000CA0000-0x0000000000CEB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads