emotet | 8c6389fc67ddcd8b8342a02825b3278e7722a319ccc71dbccdd5bbcebb7997a6

Analysis

max time kernel
134s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2024 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5748520230e32823cbc44c721687351a_JaffaCakes118.exe
Size

59KB
MD5

5748520230e32823cbc44c721687351a
SHA1

4a63a4edf47b4580b117c2f3598e2c967551997b
SHA256

8c6389fc67ddcd8b8342a02825b3278e7722a319ccc71dbccdd5bbcebb7997a6
SHA512

1030356b915e3409c449c59c87d8ade9198134e96eee1db6bba39e2bad7f2df853c32146567fe2ebb7ad8fff3b2c628a3d767f591ca3a68accabe75c132f5a56
SSDEEP

1536:LFPKA8osVxQ0Akv/Lkksc0+2NkQKwy2fgfuytUYrcArN:Z8oso0AkHHlzwcmytXn

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

200.24.248.206:80

190.112.228.47:443

142.4.198.249:7080

162.144.119.216:8080

142.93.88.16:443

31.12.67.62:7080

91.83.93.103:7080

201.220.152.101:80

60.48.253.12:20

64.13.225.150:8080

190.53.135.159:21

212.71.234.16:8080

175.100.138.82:22

78.24.219.147:8080

147.135.210.39:8080

45.33.49.124:443

104.131.11.150:8080

181.189.213.231:465

85.104.59.244:20

217.13.106.160:7080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

wancull.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	wancull.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	wancull.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	wancull.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	wancull.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

wancull.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	wancull.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	wancull.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	wancull.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

wancull.exe

pid	process
4516	wancull.exe
4516	wancull.exe
4516	wancull.exe
4516	wancull.exe
4516	wancull.exe
4516	wancull.exe
4516	wancull.exe
4516	wancull.exe
4516	wancull.exe
4516	wancull.exe
4516	wancull.exe
4516	wancull.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

5748520230e32823cbc44c721687351a_JaffaCakes118.exe

pid process

3288 5748520230e32823cbc44c721687351a_JaffaCakes118.exe

pid	process
3288	5748520230e32823cbc44c721687351a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

5748520230e32823cbc44c721687351a_JaffaCakes118.exewancull.exe

description	pid	process	target process
PID 396 wrote to memory of 3288	396	5748520230e32823cbc44c721687351a_JaffaCakes118.exe	5748520230e32823cbc44c721687351a_JaffaCakes118.exe
PID 396 wrote to memory of 3288	396	5748520230e32823cbc44c721687351a_JaffaCakes118.exe	5748520230e32823cbc44c721687351a_JaffaCakes118.exe
PID 396 wrote to memory of 3288	396	5748520230e32823cbc44c721687351a_JaffaCakes118.exe	5748520230e32823cbc44c721687351a_JaffaCakes118.exe
PID 3972 wrote to memory of 4516	3972	wancull.exe	wancull.exe
PID 3972 wrote to memory of 4516	3972	wancull.exe	wancull.exe
PID 3972 wrote to memory of 4516	3972	wancull.exe	wancull.exe

C:\Users\Admin\AppData\Local\Temp\5748520230e32823cbc44c721687351a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5748520230e32823cbc44c721687351a_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:396

C:\Users\Admin\AppData\Local\Temp\5748520230e32823cbc44c721687351a_JaffaCakes118.exe
--bd78d593
2⤵
- Suspicious behavior: RenamesItself
PID:3288

C:\Windows\SysWOW64\wancull.exe
"C:\Windows\SysWOW64\wancull.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3972

C:\Windows\SysWOW64\wancull.exe
--a79d6ccc
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4516

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3288-0-0x0000000000200000-0x0000000000215000-memory.dmp

Filesize
84KB

Download