emotet | f2b14556fb5c28adebd021802236b7b94ca1c1d5ab9fcb3a802a5d6404644428

Analysis

max time kernel
135s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64c33e1dec876047d0ad5388b2b3f68c_JaffaCakes118.exe
Size

65KB
MD5

64c33e1dec876047d0ad5388b2b3f68c
SHA1

9042eda5afe90e9ad5427f9902fa1b52636f97a3
SHA256

f2b14556fb5c28adebd021802236b7b94ca1c1d5ab9fcb3a802a5d6404644428
SHA512

8c75104f4951786b93252bb13c21c8d75c0f25ecd46455b789fcce78c2dc40b45b400bcd9e8c5e965a206984e3c4bda4725dd1dd83464d0b3c5012ca3cf28291
SSDEEP

1536:FE1SjujsC8XANkPZgJkM8Ydwqo0fdWoz5I9lKcfc6hxRGS+qzL:2LjsXANkR/fkfdWolI9AiDrzL

Score

10^/10

emotet epoch3 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

186.159.246.121:80

201.210.70.8:8080

46.105.131.68:8080

192.163.221.191:8080

124.150.175.133:80

5.189.148.98:8080

95.216.207.86:7080

189.145.6.189:80

212.112.113.235:80

187.143.219.242:8080

189.132.130.111:8080

190.96.118.15:443

190.217.1.149:80

172.104.70.207:8080

42.190.4.92:443

152.170.220.95:80

203.99.188.11:443

216.75.37.196:8080

190.55.39.215:80

185.45.24.254:7080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

chinesepdeft.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	chinesepdeft.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	chinesepdeft.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	chinesepdeft.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	chinesepdeft.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

chinesepdeft.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	chinesepdeft.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	chinesepdeft.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	chinesepdeft.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

chinesepdeft.exe

pid	process
3104	chinesepdeft.exe
3104	chinesepdeft.exe
3104	chinesepdeft.exe
3104	chinesepdeft.exe
3104	chinesepdeft.exe
3104	chinesepdeft.exe
3104	chinesepdeft.exe
3104	chinesepdeft.exe
3104	chinesepdeft.exe
3104	chinesepdeft.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

64c33e1dec876047d0ad5388b2b3f68c_JaffaCakes118.exe

pid process

216 64c33e1dec876047d0ad5388b2b3f68c_JaffaCakes118.exe

pid	process
216	64c33e1dec876047d0ad5388b2b3f68c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

64c33e1dec876047d0ad5388b2b3f68c_JaffaCakes118.exechinesepdeft.exe

description	pid	process	target process
PID 3156 wrote to memory of 216	3156	64c33e1dec876047d0ad5388b2b3f68c_JaffaCakes118.exe	64c33e1dec876047d0ad5388b2b3f68c_JaffaCakes118.exe
PID 3156 wrote to memory of 216	3156	64c33e1dec876047d0ad5388b2b3f68c_JaffaCakes118.exe	64c33e1dec876047d0ad5388b2b3f68c_JaffaCakes118.exe
PID 3156 wrote to memory of 216	3156	64c33e1dec876047d0ad5388b2b3f68c_JaffaCakes118.exe	64c33e1dec876047d0ad5388b2b3f68c_JaffaCakes118.exe
PID 1412 wrote to memory of 3104	1412	chinesepdeft.exe	chinesepdeft.exe
PID 1412 wrote to memory of 3104	1412	chinesepdeft.exe	chinesepdeft.exe
PID 1412 wrote to memory of 3104	1412	chinesepdeft.exe	chinesepdeft.exe

C:\Users\Admin\AppData\Local\Temp\64c33e1dec876047d0ad5388b2b3f68c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\64c33e1dec876047d0ad5388b2b3f68c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3156

C:\Users\Admin\AppData\Local\Temp\64c33e1dec876047d0ad5388b2b3f68c_JaffaCakes118.exe
--2411a822
2⤵
- Suspicious behavior: RenamesItself
PID:216

C:\Windows\SysWOW64\chinesepdeft.exe
"C:\Windows\SysWOW64\chinesepdeft.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1412

C:\Windows\SysWOW64\chinesepdeft.exe
--46283344
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3104

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/216-0-0x0000000000FD0000-0x0000000000FE7000-memory.dmp

Filesize
92KB

Download