emotet | 9dd242fda4f305662555852b45cee283b3e338207a18263c0004cb111d57766c

General

Target

59d10dab0637b1608a97f3e36899082e_JaffaCakes118.exe
Size

312KB
MD5

59d10dab0637b1608a97f3e36899082e
SHA1

9c8deca1189a84a8ca59d3f71da352b9f3488f2a
SHA256

9dd242fda4f305662555852b45cee283b3e338207a18263c0004cb111d57766c
SHA512

40cbd2c40601b4c6b3f4eeea2dd4e6880bc68ddc28ed0e097776127319451a7712e478c1f79825867f10a2e727e2fba5482cce609f7bcb13cb1391ea9789b38b
SSDEEP

6144:Bph2KiYC3aZBTVItzt3QlpLV0IjLKdJr2qKiTstk:BViYC3aZU53QuIjLKdwGge

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

68.187.160.28:443

97.120.32.227:80

187.188.166.192:8080

144.217.117.207:8080

96.126.121.64:443

104.236.137.72:8080

85.234.143.94:8080

68.174.15.223:80

63.246.252.234:80

93.148.252.90:80

74.59.187.94:80

185.160.212.3:80

46.28.111.142:7080

183.99.239.141:80

68.129.203.162:443

144.139.56.105:80

191.183.21.190:80

81.157.234.90:8080

138.68.106.4:7080

203.130.0.69:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

deployspeed.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	deployspeed.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

deployspeed.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	deployspeed.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	deployspeed.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	deployspeed.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	deployspeed.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{10A52142-7252-451C-97D7-325E0A5C3C76}\WpadDecision = "0"	deployspeed.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{10A52142-7252-451C-97D7-325E0A5C3C76}\WpadNetworkName = "Network 3"	deployspeed.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	deployspeed.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	deployspeed.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{10A52142-7252-451C-97D7-325E0A5C3C76}	deployspeed.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-8f-56-e4-0d-35\WpadDecisionTime = 206ce827d3a9da01	deployspeed.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	deployspeed.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	deployspeed.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{10A52142-7252-451C-97D7-325E0A5C3C76}\WpadDecisionReason = "1"	deployspeed.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{10A52142-7252-451C-97D7-325E0A5C3C76}\86-8f-56-e4-0d-35	deployspeed.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	deployspeed.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	deployspeed.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00cc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	deployspeed.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{10A52142-7252-451C-97D7-325E0A5C3C76}\WpadDecisionTime = 206ce827d3a9da01	deployspeed.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-8f-56-e4-0d-35	deployspeed.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-8f-56-e4-0d-35\WpadDecisionReason = "1"	deployspeed.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-8f-56-e4-0d-35\WpadDecision = "0"	deployspeed.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

deployspeed.exe

pid process

2740 deployspeed.exe
2740 deployspeed.exe
2740 deployspeed.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

59d10dab0637b1608a97f3e36899082e_JaffaCakes118.exe

pid process

2860 59d10dab0637b1608a97f3e36899082e_JaffaCakes118.exe

pid	process
2740	deployspeed.exe
2740	deployspeed.exe
2740	deployspeed.exe

pid	process
2860	59d10dab0637b1608a97f3e36899082e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

59d10dab0637b1608a97f3e36899082e_JaffaCakes118.exe59d10dab0637b1608a97f3e36899082e_JaffaCakes118.exedeployspeed.exedeployspeed.exe

pid	process
1860	59d10dab0637b1608a97f3e36899082e_JaffaCakes118.exe
1860	59d10dab0637b1608a97f3e36899082e_JaffaCakes118.exe
2860	59d10dab0637b1608a97f3e36899082e_JaffaCakes118.exe
2860	59d10dab0637b1608a97f3e36899082e_JaffaCakes118.exe
2656	deployspeed.exe
2656	deployspeed.exe
2740	deployspeed.exe
2740	deployspeed.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

59d10dab0637b1608a97f3e36899082e_JaffaCakes118.exedeployspeed.exe

description	pid	process	target process
PID 1860 wrote to memory of 2860	1860	59d10dab0637b1608a97f3e36899082e_JaffaCakes118.exe	59d10dab0637b1608a97f3e36899082e_JaffaCakes118.exe
PID 1860 wrote to memory of 2860	1860	59d10dab0637b1608a97f3e36899082e_JaffaCakes118.exe	59d10dab0637b1608a97f3e36899082e_JaffaCakes118.exe
PID 1860 wrote to memory of 2860	1860	59d10dab0637b1608a97f3e36899082e_JaffaCakes118.exe	59d10dab0637b1608a97f3e36899082e_JaffaCakes118.exe
PID 1860 wrote to memory of 2860	1860	59d10dab0637b1608a97f3e36899082e_JaffaCakes118.exe	59d10dab0637b1608a97f3e36899082e_JaffaCakes118.exe
PID 2656 wrote to memory of 2740	2656	deployspeed.exe	deployspeed.exe
PID 2656 wrote to memory of 2740	2656	deployspeed.exe	deployspeed.exe
PID 2656 wrote to memory of 2740	2656	deployspeed.exe	deployspeed.exe
PID 2656 wrote to memory of 2740	2656	deployspeed.exe	deployspeed.exe

C:\Users\Admin\AppData\Local\Temp\59d10dab0637b1608a97f3e36899082e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\59d10dab0637b1608a97f3e36899082e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860

C:\Users\Admin\AppData\Local\Temp\59d10dab0637b1608a97f3e36899082e_JaffaCakes118.exe
--25db4f64
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2860

C:\Windows\SysWOW64\deployspeed.exe
"C:\Windows\SysWOW64\deployspeed.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656

C:\Windows\SysWOW64\deployspeed.exe
--ac917bd6
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1860-0-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1860-1-0x0000000000540000-0x0000000000557000-memory.dmp

Filesize
92KB

Download
memory/1860-6-0x0000000000280000-0x0000000000291000-memory.dmp

Filesize
68KB

Download
memory/2656-12-0x00000000003E0000-0x00000000003F7000-memory.dmp

Filesize
92KB

Download
memory/2740-18-0x0000000000520000-0x0000000000537000-memory.dmp

Filesize
92KB

Download
memory/2860-7-0x00000000005F0000-0x0000000000607000-memory.dmp

Filesize
92KB

Download
memory/2860-17-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads