emotet | 5638332978984303342b0e7f6d86b6d2a0122c166c6184414b75a40c64b96990

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe
Size 267KB
Sample240519-jbxlmsgf3w
SHA256 5638332978984303342b0e7f6d86b6d2a0122c166c6184414b75a40c64b96990
MD5 593f33b5ab1a83bfdd8dc1b52c9b4709
SHA1 3fbd1b61716acd1f5bc4e8efcf2e30626f58e6f3
SHA512 c5a13ac20fb29c192061f72b52b6070f0e9e487b53f34aa7bb6ea673963dfb0d836c1211ce64654584acdad958a7380cf440e893dbcc3cda1815fb09566093d4
SSDEEP 6144:RQTvKi6ThBpY+cerayRzcEXOi8oAqUkc0lHZ68GC:RKekkra47X0qUkc0cC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch3 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

186.84.173.153:80
181.36.42.205:443
190.166.25.99:80
131.0.103.200:8080
78.46.103.90:7080
94.177.253.126:80
120.138.101.250:80
200.55.168.82:20
75.154.163.1:8090
95.216.207.86:7080
190.96.118.15:443
144.76.62.10:8080
212.112.113.235:80
184.82.233.15:80
157.7.164.178:8081
113.52.135.33:7080
176.58.93.123:80
51.38.134.203:8080
190.228.212.165:50000
203.99.188.11:443
181.61.143.177:80
216.70.88.55:8080
181.47.235.26:993
190.113.146.128:8080
216.75.37.196:8080
83.169.33.157:8080
201.196.15.79:990
91.109.5.28:8080
70.32.94.58:8080
186.109.91.136:80
186.146.110.108:8080
181.99.223.250:8080
192.241.220.183:8080
5.189.148.98:8080
190.117.206.153:443
186.92.11.143:8080
203.99.188.203:990
138.197.140.163:8080
190.13.146.47:443
185.45.24.254:7080
143.95.101.72:8080
203.99.182.135:443
201.217.113.58:8080
203.99.187.137:443
178.249.187.150:7080
154.120.227.206:8080
152.170.220.95:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	typebchunker.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	typebchunker.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	typebchunker.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	typebchunker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	typebchunker.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	typebchunker.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	typebchunker.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4216	typebchunker.exe
4216	typebchunker.exe
4216	typebchunker.exe
4216	typebchunker.exe
4216	typebchunker.exe
4216	typebchunker.exe
4216	typebchunker.exe
4216	typebchunker.exe
4216	typebchunker.exe
4216	typebchunker.exe
4216	typebchunker.exe
4216	typebchunker.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1916	593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
220	593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe
220	593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe
1916	593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe
1916	593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe
1840	typebchunker.exe
1840	typebchunker.exe
4216	typebchunker.exe
4216	typebchunker.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 1916	220	593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe	83
PID 220 wrote to memory of 1916	220	593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe	83
PID 220 wrote to memory of 1916	220	593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe	83
PID 1840 wrote to memory of 4216	1840	typebchunker.exe	97
PID 1840 wrote to memory of 4216	1840	typebchunker.exe	97
PID 1840 wrote to memory of 4216	1840	typebchunker.exe	97

C:\Users\Admin\AppData\Local\Temp\593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:220
- C:\Users\Admin\AppData\Local\Temp\593f33b5ab1a83bfdd8dc1b52c9b4709_JaffaCakes118.exe
  --a5f914b9
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  PID:1916

C:\Windows\SysWOW64\typebchunker.exe
"C:\Windows\SysWOW64\typebchunker.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\SysWOW64\typebchunker.exe
  --64611ee4
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/220-0-0x00000000022D0000-0x00000000022E7000-memory.dmp

Download

memory/220-5-0x0000000002290000-0x00000000022A1000-memory.dmp

Download

memory/1840-11-0x0000000000E40000-0x0000000000E57000-memory.dmp

Download

memory/1916-6-0x0000000002280000-0x0000000002297000-memory.dmp

Download

memory/1916-16-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/4216-17-0x0000000000E50000-0x0000000000E67000-memory.dmp

Download