emotet | 1f0a680d6371c881837f94db5b603571c510c8eaea511e77498427eae944420e

General

Target

65368ea5adaeeca3a9f75efdeebc466d_JaffaCakes118.exe
Size

336KB
MD5

65368ea5adaeeca3a9f75efdeebc466d
SHA1

b8e18a8852931c4a6fb9053d50c1a3fe82a9b5db
SHA256

1f0a680d6371c881837f94db5b603571c510c8eaea511e77498427eae944420e
SHA512

206e28a45de716054b852f2defe5adc2b7f4fa032545b8ccc2c6511848a83949c86e45d4d467f7b7a83f05370c0191f4fec55f4e165a89373d6f724e66ff60b1
SSDEEP

6144:G6RABINtOofnGFxg9930Rgr35LvHdv9ZObVSa6frUnPzwT:GyABIN8oIg9FPvOGYnPA

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

152.170.108.99:443

99.252.27.6:80

93.148.252.90:80

96.126.121.64:443

104.236.137.72:8080

85.234.143.94:8080

80.85.87.122:8080

2.139.158.136:443

80.11.158.65:8080

79.31.85.103:80

77.55.211.77:8080

96.61.113.203:80

181.198.203.45:443

142.93.114.137:8080

186.15.83.52:8080

181.36.42.205:443

68.183.190.199:8080

159.203.204.126:8080

50.28.51.143:8080

46.101.212.195:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

trnsgroup.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	trnsgroup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

trnsgroup.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	trnsgroup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	trnsgroup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	trnsgroup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	trnsgroup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	trnsgroup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-38-e2-66-6c-a1\WpadDecisionReason = "1"	trnsgroup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8829A0F-3A71-4B6E-8834-94893B633852}	trnsgroup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8829A0F-3A71-4B6E-8834-94893B633852}\WpadDecisionTime = 6021b243d8abda01	trnsgroup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-38-e2-66-6c-a1	trnsgroup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8829A0F-3A71-4B6E-8834-94893B633852}\WpadDecisionReason = "1"	trnsgroup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8829A0F-3A71-4B6E-8834-94893B633852}\WpadDecision = "0"	trnsgroup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8829A0F-3A71-4B6E-8834-94893B633852}\WpadNetworkName = "Network 2"	trnsgroup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8829A0F-3A71-4B6E-8834-94893B633852}\5a-38-e2-66-6c-a1	trnsgroup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-38-e2-66-6c-a1\WpadDecision = "0"	trnsgroup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	trnsgroup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	trnsgroup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	trnsgroup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-38-e2-66-6c-a1\WpadDecisionTime = 6021b243d8abda01	trnsgroup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	trnsgroup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	trnsgroup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	trnsgroup.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

trnsgroup.exe

pid process

2912 trnsgroup.exe
2912 trnsgroup.exe
2912 trnsgroup.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

65368ea5adaeeca3a9f75efdeebc466d_JaffaCakes118.exe

pid process

1628 65368ea5adaeeca3a9f75efdeebc466d_JaffaCakes118.exe

pid	process
2912	trnsgroup.exe
2912	trnsgroup.exe
2912	trnsgroup.exe

pid	process
1628	65368ea5adaeeca3a9f75efdeebc466d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

65368ea5adaeeca3a9f75efdeebc466d_JaffaCakes118.exe65368ea5adaeeca3a9f75efdeebc466d_JaffaCakes118.exetrnsgroup.exetrnsgroup.exe

pid	process
1556	65368ea5adaeeca3a9f75efdeebc466d_JaffaCakes118.exe
1628	65368ea5adaeeca3a9f75efdeebc466d_JaffaCakes118.exe
1560	trnsgroup.exe
2912	trnsgroup.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

65368ea5adaeeca3a9f75efdeebc466d_JaffaCakes118.exetrnsgroup.exe

description	pid	process	target process
PID 1556 wrote to memory of 1628	1556	65368ea5adaeeca3a9f75efdeebc466d_JaffaCakes118.exe	65368ea5adaeeca3a9f75efdeebc466d_JaffaCakes118.exe
PID 1556 wrote to memory of 1628	1556	65368ea5adaeeca3a9f75efdeebc466d_JaffaCakes118.exe	65368ea5adaeeca3a9f75efdeebc466d_JaffaCakes118.exe
PID 1556 wrote to memory of 1628	1556	65368ea5adaeeca3a9f75efdeebc466d_JaffaCakes118.exe	65368ea5adaeeca3a9f75efdeebc466d_JaffaCakes118.exe
PID 1556 wrote to memory of 1628	1556	65368ea5adaeeca3a9f75efdeebc466d_JaffaCakes118.exe	65368ea5adaeeca3a9f75efdeebc466d_JaffaCakes118.exe
PID 1560 wrote to memory of 2912	1560	trnsgroup.exe	trnsgroup.exe
PID 1560 wrote to memory of 2912	1560	trnsgroup.exe	trnsgroup.exe
PID 1560 wrote to memory of 2912	1560	trnsgroup.exe	trnsgroup.exe
PID 1560 wrote to memory of 2912	1560	trnsgroup.exe	trnsgroup.exe

C:\Users\Admin\AppData\Local\Temp\65368ea5adaeeca3a9f75efdeebc466d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65368ea5adaeeca3a9f75efdeebc466d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1556

C:\Users\Admin\AppData\Local\Temp\65368ea5adaeeca3a9f75efdeebc466d_JaffaCakes118.exe
--1f55312e
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1628

C:\Windows\SysWOW64\trnsgroup.exe
"C:\Windows\SysWOW64\trnsgroup.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560

C:\Windows\SysWOW64\trnsgroup.exe
--333db892
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2912

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1556-0-0x0000000000350000-0x0000000000367000-memory.dmp

Filesize
92KB

Download
memory/1560-10-0x0000000000260000-0x0000000000277000-memory.dmp

Filesize
92KB

Download
memory/1628-5-0x00000000002F0000-0x0000000000307000-memory.dmp

Filesize
92KB

Download
memory/1628-15-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2912-16-0x00000000003B0000-0x00000000003C7000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads