emotet | ccc579f1b0a5c1ddb141c4af99ac8e3cbd7b86e35477f0ff3c0b8500c32a8a1e

General

Target

53c0991fbe9dd8abcf27e3e0eb7a34be_JaffaCakes118.exe
Size

603KB
MD5

53c0991fbe9dd8abcf27e3e0eb7a34be
SHA1

8474315c356f4fc8ce070d9b9e070644fad579d2
SHA256

ccc579f1b0a5c1ddb141c4af99ac8e3cbd7b86e35477f0ff3c0b8500c32a8a1e
SHA512

4893bcd4ea3a1cd357d8b966d9a1166bb463727ed29bb886d1ab592422d50483e210b0ee6a6e97b0c6d6dde1a12eb410f2092fcdd7dd7770a0738e6e2717d2a7
SSDEEP

12288:BkfdhQmseiH0lXPftSfWOOOR9tQdj363A+S:BEqcftSLVQdj363A+S

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

2.38.99.79:80

98.24.231.64:80

47.156.70.145:80

37.59.24.177:8080

66.34.201.20:7080

108.179.206.219:8080

45.56.88.91:443

206.189.112.148:8080

120.150.246.241:80

190.56.255.118:80

200.71.148.138:8080

192.241.255.77:8080

211.63.71.72:8080

190.53.135.159:21

183.102.238.69:465

108.191.2.72:80

107.170.24.125:8080

167.114.242.226:8080

91.73.197.90:80

178.209.71.63:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

pdfattrib.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	pdfattrib.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	pdfattrib.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	pdfattrib.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	pdfattrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

pdfattrib.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	pdfattrib.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	pdfattrib.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	pdfattrib.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

pdfattrib.exe

pid process

4888 pdfattrib.exe
4888 pdfattrib.exe
4888 pdfattrib.exe
4888 pdfattrib.exe
4888 pdfattrib.exe
4888 pdfattrib.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

53c0991fbe9dd8abcf27e3e0eb7a34be_JaffaCakes118.exe

pid process

6048 53c0991fbe9dd8abcf27e3e0eb7a34be_JaffaCakes118.exe

pid	process
4888	pdfattrib.exe
4888	pdfattrib.exe
4888	pdfattrib.exe
4888	pdfattrib.exe
4888	pdfattrib.exe
4888	pdfattrib.exe

pid	process
6048	53c0991fbe9dd8abcf27e3e0eb7a34be_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

53c0991fbe9dd8abcf27e3e0eb7a34be_JaffaCakes118.exe53c0991fbe9dd8abcf27e3e0eb7a34be_JaffaCakes118.exepdfattrib.exepdfattrib.exe

pid	process
5796	53c0991fbe9dd8abcf27e3e0eb7a34be_JaffaCakes118.exe
5796	53c0991fbe9dd8abcf27e3e0eb7a34be_JaffaCakes118.exe
6048	53c0991fbe9dd8abcf27e3e0eb7a34be_JaffaCakes118.exe
6048	53c0991fbe9dd8abcf27e3e0eb7a34be_JaffaCakes118.exe
4076	pdfattrib.exe
4076	pdfattrib.exe
4888	pdfattrib.exe
4888	pdfattrib.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

53c0991fbe9dd8abcf27e3e0eb7a34be_JaffaCakes118.exepdfattrib.exe

description	pid	process	target process
PID 5796 wrote to memory of 6048	5796	53c0991fbe9dd8abcf27e3e0eb7a34be_JaffaCakes118.exe	53c0991fbe9dd8abcf27e3e0eb7a34be_JaffaCakes118.exe
PID 5796 wrote to memory of 6048	5796	53c0991fbe9dd8abcf27e3e0eb7a34be_JaffaCakes118.exe	53c0991fbe9dd8abcf27e3e0eb7a34be_JaffaCakes118.exe
PID 5796 wrote to memory of 6048	5796	53c0991fbe9dd8abcf27e3e0eb7a34be_JaffaCakes118.exe	53c0991fbe9dd8abcf27e3e0eb7a34be_JaffaCakes118.exe
PID 4076 wrote to memory of 4888	4076	pdfattrib.exe	pdfattrib.exe
PID 4076 wrote to memory of 4888	4076	pdfattrib.exe	pdfattrib.exe
PID 4076 wrote to memory of 4888	4076	pdfattrib.exe	pdfattrib.exe

C:\Users\Admin\AppData\Local\Temp\53c0991fbe9dd8abcf27e3e0eb7a34be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\53c0991fbe9dd8abcf27e3e0eb7a34be_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5796

C:\Users\Admin\AppData\Local\Temp\53c0991fbe9dd8abcf27e3e0eb7a34be_JaffaCakes118.exe
--df6b1e5b
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:6048

C:\Windows\SysWOW64\pdfattrib.exe
"C:\Windows\SysWOW64\pdfattrib.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4076

C:\Windows\SysWOW64\pdfattrib.exe
--5cac3db2
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4076-13-0x0000000000E50000-0x0000000000E67000-memory.dmp

Filesize
92KB

Download
memory/4888-19-0x0000000000E30000-0x0000000000E47000-memory.dmp

Filesize
92KB

Download
memory/5796-0-0x0000000002280000-0x0000000002297000-memory.dmp

Filesize
92KB

Download
memory/5796-5-0x0000000002260000-0x0000000002271000-memory.dmp

Filesize
68KB

Download
memory/6048-6-0x00000000021B0000-0x00000000021C7000-memory.dmp

Filesize
92KB

Download
memory/6048-11-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/6048-18-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads