emotet | 8ac484407e6f7e10e97b5b32f72494cf0099ad3b7a1c2ed6f09b6856a963fd8b

General

Target

6382e60479cb0ab0cf9fbf6b456d5580_JaffaCakes118.exe
Size

425KB
MD5

6382e60479cb0ab0cf9fbf6b456d5580
SHA1

62fba9c60d2374a9d1d300638795ac0fc8297c98
SHA256

8ac484407e6f7e10e97b5b32f72494cf0099ad3b7a1c2ed6f09b6856a963fd8b
SHA512

09367269f7668f004e0b5ea4d1235a39439d0893c58cf2f6db09ece2fae1c4a04051fe19049c8054a726e58f5876a338ce01216e9dbd84fbe25372f17cf487d9
SSDEEP

6144:6riTApO8CLavbVUGXjDsDaKaIwLnhc/WGLeGFL7h11UOvTmgyyyyyyyyyyyyyyyg:DGXqzacuGfFxUO7mQDi+6Y

Score

10^/10

emotet epoch3 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

186.159.246.121:80

201.210.70.8:8080

46.105.131.68:8080

192.163.221.191:8080

124.150.175.133:80

5.189.148.98:8080

95.216.207.86:7080

189.145.6.189:80

212.112.113.235:80

187.143.219.242:8080

189.132.130.111:8080

190.96.118.15:443

190.217.1.149:80

172.104.70.207:8080

42.190.4.92:443

152.170.220.95:80

203.99.188.11:443

216.75.37.196:8080

190.55.39.215:80

185.45.24.254:7080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 4 IoCs

Processes:

6382e60479cb0ab0cf9fbf6b456d5580_JaffaCakes118.exe6382e60479cb0ab0cf9fbf6b456d5580_JaffaCakes118.execrashwith.execrashwith.exe

pid	process
3916	6382e60479cb0ab0cf9fbf6b456d5580_JaffaCakes118.exe
5036	6382e60479cb0ab0cf9fbf6b456d5580_JaffaCakes118.exe
5020	crashwith.exe
560	crashwith.exe

Drops file in System32 directory 4 IoCs

Processes:

crashwith.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	crashwith.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	crashwith.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	crashwith.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	crashwith.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

crashwith.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	crashwith.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	crashwith.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	crashwith.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

crashwith.exe

pid	process
560	crashwith.exe
560	crashwith.exe
560	crashwith.exe
560	crashwith.exe
560	crashwith.exe
560	crashwith.exe
560	crashwith.exe
560	crashwith.exe
560	crashwith.exe
560	crashwith.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

6382e60479cb0ab0cf9fbf6b456d5580_JaffaCakes118.exe

pid process

5036 6382e60479cb0ab0cf9fbf6b456d5580_JaffaCakes118.exe

pid	process
5036	6382e60479cb0ab0cf9fbf6b456d5580_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

6382e60479cb0ab0cf9fbf6b456d5580_JaffaCakes118.execrashwith.exe

description	pid	process	target process
PID 3916 wrote to memory of 5036	3916	6382e60479cb0ab0cf9fbf6b456d5580_JaffaCakes118.exe	6382e60479cb0ab0cf9fbf6b456d5580_JaffaCakes118.exe
PID 3916 wrote to memory of 5036	3916	6382e60479cb0ab0cf9fbf6b456d5580_JaffaCakes118.exe	6382e60479cb0ab0cf9fbf6b456d5580_JaffaCakes118.exe
PID 3916 wrote to memory of 5036	3916	6382e60479cb0ab0cf9fbf6b456d5580_JaffaCakes118.exe	6382e60479cb0ab0cf9fbf6b456d5580_JaffaCakes118.exe
PID 5020 wrote to memory of 560	5020	crashwith.exe	crashwith.exe
PID 5020 wrote to memory of 560	5020	crashwith.exe	crashwith.exe
PID 5020 wrote to memory of 560	5020	crashwith.exe	crashwith.exe

C:\Users\Admin\AppData\Local\Temp\6382e60479cb0ab0cf9fbf6b456d5580_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6382e60479cb0ab0cf9fbf6b456d5580_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3916

C:\Users\Admin\AppData\Local\Temp\6382e60479cb0ab0cf9fbf6b456d5580_JaffaCakes118.exe
--efeeb35f
2⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
PID:5036

C:\Windows\SysWOW64\crashwith.exe
"C:\Windows\SysWOW64\crashwith.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5020

C:\Windows\SysWOW64\crashwith.exe
--3052a263
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\01edac8cae020cd42786e051ebe37b67_6833eb7b-8d4b-4cdd-9502-9bbf7fc1cf9f
Filesize
50B

MD5
5f22af36aff2e43cacf9a56ba4166900

SHA1
914ede992f5edd5523a3a127a88f7bca60c69665

SHA256
e0671a7dbf4fca7d937ff1300471c5823a57786710faba9f85daf9e843281e3a

SHA512
f7fd666c6dcdae2bf235bb2b00791cf00519579e3181e5e3fd67e70c9a4027d48335b6498f6116efa5e513b7750b0eebeb484a63555d277939923bb48d4f3bc8

Download Submit
C:\ProgramData\xcsdwrsdk.dtxsd
Filesize
252KB

MD5
f49649b15d90908b3ac0baecd57e30e0

SHA1
678b22cee4d6c0d2a54cd4f2d80c7b45a8bfeba2

SHA256
72d818b2293c945fdfa639c69c504f87e89d41062a8c0902e1a5093bca39597a

SHA512
1c74c63ece7ee369a65540f8aa934d248bb806306c58849cf2c9d85c2114248fd472b3d17c0485bbefc0bcf2705544b31d18290bcd0fc6e680900d48b7804433

Download Submit
memory/560-35-0x00000000010E0000-0x00000000010F7000-memory.dmp

Filesize
92KB

Download
memory/560-41-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3916-11-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3916-12-0x0000000002670000-0x0000000002681000-memory.dmp

Filesize
68KB

Download
memory/3916-6-0x0000000002690000-0x00000000026A7000-memory.dmp

Filesize
92KB

Download
memory/5020-27-0x0000000001250000-0x0000000001267000-memory.dmp

Filesize
92KB

Download
memory/5020-32-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/5036-20-0x0000000000AB0000-0x0000000000AC7000-memory.dmp

Filesize
92KB

Download
memory/5036-40-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads