emotet | 834c2ad4ab0a0024b885975208847ba04beb4274944d0014e9823361747411f0

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d17e134d24edaeb3fe5e3937b502843_JaffaCakes118.exe
Size

380KB
MD5

5d17e134d24edaeb3fe5e3937b502843
SHA1

600c5e9971a376a99e4528f4261aa207b24a2303
SHA256

834c2ad4ab0a0024b885975208847ba04beb4274944d0014e9823361747411f0
SHA512

f896bbdf4728efb64f04cddc79ed15a792d8b5d30d4d6761d19bad5ee8ff75e94647e82aaa0f33cd88900725b5dd3ccdf5de1b32e990cc66833878723cfa42fc
SSDEEP

3072:KJFSZujJRF9CwQEp4JiTLZ+1mEu/l/Jp3SufIDL1Mf6js9Cv/4OL3IHGJRJ:KJFScLF40+Zu/l/jSufIZMSAogOLbB

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

107.170.27.84:443

85.234.143.94:8080

204.225.249.100:8080

173.212.220.251:443

60.54.37.25:80

178.249.187.151:8080

91.83.93.124:7080

77.245.101.134:8080

68.183.190.199:8080

203.25.159.3:8080

41.75.135.93:7080

46.28.111.142:7080

163.172.40.218:7080

45.79.95.107:443

181.198.203.45:443

185.86.148.222:8080

181.231.62.54:80

186.23.132.93:990

46.29.183.211:8080

62.75.143.100:7080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

funcpublish.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	funcpublish.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	funcpublish.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	funcpublish.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	funcpublish.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

funcpublish.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	funcpublish.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	funcpublish.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	funcpublish.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

funcpublish.exe

pid	process
832	funcpublish.exe
832	funcpublish.exe
832	funcpublish.exe
832	funcpublish.exe
832	funcpublish.exe
832	funcpublish.exe
832	funcpublish.exe
832	funcpublish.exe
832	funcpublish.exe
832	funcpublish.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

5d17e134d24edaeb3fe5e3937b502843_JaffaCakes118.exe

pid process

4012 5d17e134d24edaeb3fe5e3937b502843_JaffaCakes118.exe

pid	process
4012	5d17e134d24edaeb3fe5e3937b502843_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

5d17e134d24edaeb3fe5e3937b502843_JaffaCakes118.exefuncpublish.exe

description	pid	process	target process
PID 4044 wrote to memory of 4012	4044	5d17e134d24edaeb3fe5e3937b502843_JaffaCakes118.exe	5d17e134d24edaeb3fe5e3937b502843_JaffaCakes118.exe
PID 4044 wrote to memory of 4012	4044	5d17e134d24edaeb3fe5e3937b502843_JaffaCakes118.exe	5d17e134d24edaeb3fe5e3937b502843_JaffaCakes118.exe
PID 4044 wrote to memory of 4012	4044	5d17e134d24edaeb3fe5e3937b502843_JaffaCakes118.exe	5d17e134d24edaeb3fe5e3937b502843_JaffaCakes118.exe
PID 1552 wrote to memory of 832	1552	funcpublish.exe	funcpublish.exe
PID 1552 wrote to memory of 832	1552	funcpublish.exe	funcpublish.exe
PID 1552 wrote to memory of 832	1552	funcpublish.exe	funcpublish.exe

C:\Users\Admin\AppData\Local\Temp\5d17e134d24edaeb3fe5e3937b502843_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5d17e134d24edaeb3fe5e3937b502843_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4044

C:\Users\Admin\AppData\Local\Temp\5d17e134d24edaeb3fe5e3937b502843_JaffaCakes118.exe
--d01c0bbd
2⤵
- Suspicious behavior: RenamesItself
PID:4012

C:\Windows\SysWOW64\funcpublish.exe
"C:\Windows\SysWOW64\funcpublish.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\SysWOW64\funcpublish.exe
--16268d01
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:832

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\34d3a988f91ae65f6b6a47e5f2aee2fe_4d0966de-9ba4-4ee9-b282-eaf9cf9c9160
Filesize
50B

MD5
04b6e4dabf9730986a6cc4c0d9d3d8a8

SHA1
f3a1e1db743d79c4140886fcb3a226310f72d3c6

SHA256
34f78f9a53419725698ba1075618e448e0f7cdd6c26fdd915ea558c31bde3869

SHA512
163d327a4f7a976c579be3b1115eda4e4ef2711b858f792dc70a76a82e679e804a2a8ce91792a11b22e293540842abf5ad279cf8e0606da2a2b43e458f8f37ad

Download Submit
memory/1552-14-0x0000000000DC0000-0x0000000000DD7000-memory.dmp

Filesize
92KB

Download
memory/4012-6-0x0000000000610000-0x0000000000627000-memory.dmp

Filesize
92KB

Download
memory/4012-11-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4012-18-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4044-0-0x0000000002B30000-0x0000000002B47000-memory.dmp

Filesize
92KB

Download
memory/4044-5-0x0000000000A10000-0x0000000000A21000-memory.dmp

Filesize
68KB

Download