emotet | 4f03705e248f307c693af5a0a560d435c0590144c280e7df962d97adbf0d6416

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 08:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a65c3a66cc3168ae6187ea6a1ab5d43_JaffaCakes118.exe
Size

320KB
MD5

6a65c3a66cc3168ae6187ea6a1ab5d43
SHA1

a4abe68aec6ff1ec1a5e31551284c9365fbc0bbe
SHA256

4f03705e248f307c693af5a0a560d435c0590144c280e7df962d97adbf0d6416
SHA512

5b81d8f324ecf89357d6b6863d5b1aa79ee2cc1ca14329e8e71a1a9137cc447652e29c904da0e024ff554df1cc91f2ac8e26ada304a2d68d026ac15964f1ea85
SSDEEP

6144:FmsuMp/+Nu3Q6e73qE9TMp5pQPNbwLzJWj:FZfpaube7vTC5aGWj

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

172.104.233.225:8080

70.32.78.99:8080

213.189.36.51:8080

107.170.27.84:443

87.106.77.40:7080

77.55.211.77:8080

201.190.133.235:8080

181.16.17.210:443

87.118.70.69:8080

45.79.95.107:443

111.119.233.65:80

138.68.106.4:7080

200.113.106.18:80

170.130.31.177:8080

91.83.93.124:7080

212.71.237.140:8080

76.69.29.42:80

50.28.51.143:8080

68.183.190.199:8080

190.146.131.105:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

groupmonthly.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	groupmonthly.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	groupmonthly.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	groupmonthly.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	groupmonthly.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

groupmonthly.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	groupmonthly.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	groupmonthly.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	groupmonthly.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

groupmonthly.exe

pid	process
4132	groupmonthly.exe
4132	groupmonthly.exe
4132	groupmonthly.exe
4132	groupmonthly.exe
4132	groupmonthly.exe
4132	groupmonthly.exe
4132	groupmonthly.exe
4132	groupmonthly.exe
4132	groupmonthly.exe
4132	groupmonthly.exe
4132	groupmonthly.exe
4132	groupmonthly.exe
4132	groupmonthly.exe
4132	groupmonthly.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

6a65c3a66cc3168ae6187ea6a1ab5d43_JaffaCakes118.exe

pid process

2440 6a65c3a66cc3168ae6187ea6a1ab5d43_JaffaCakes118.exe

pid	process
2440	6a65c3a66cc3168ae6187ea6a1ab5d43_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

6a65c3a66cc3168ae6187ea6a1ab5d43_JaffaCakes118.exegroupmonthly.exe

description	pid	process	target process
PID 3164 wrote to memory of 2440	3164	6a65c3a66cc3168ae6187ea6a1ab5d43_JaffaCakes118.exe	6a65c3a66cc3168ae6187ea6a1ab5d43_JaffaCakes118.exe
PID 3164 wrote to memory of 2440	3164	6a65c3a66cc3168ae6187ea6a1ab5d43_JaffaCakes118.exe	6a65c3a66cc3168ae6187ea6a1ab5d43_JaffaCakes118.exe
PID 3164 wrote to memory of 2440	3164	6a65c3a66cc3168ae6187ea6a1ab5d43_JaffaCakes118.exe	6a65c3a66cc3168ae6187ea6a1ab5d43_JaffaCakes118.exe
PID 4416 wrote to memory of 4132	4416	groupmonthly.exe	groupmonthly.exe
PID 4416 wrote to memory of 4132	4416	groupmonthly.exe	groupmonthly.exe
PID 4416 wrote to memory of 4132	4416	groupmonthly.exe	groupmonthly.exe

C:\Users\Admin\AppData\Local\Temp\6a65c3a66cc3168ae6187ea6a1ab5d43_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6a65c3a66cc3168ae6187ea6a1ab5d43_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3164

C:\Users\Admin\AppData\Local\Temp\6a65c3a66cc3168ae6187ea6a1ab5d43_JaffaCakes118.exe
--fee6b4a0
2⤵
- Suspicious behavior: RenamesItself
PID:2440

C:\Windows\SysWOW64\groupmonthly.exe
"C:\Windows\SysWOW64\groupmonthly.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4416

C:\Windows\SysWOW64\groupmonthly.exe
--e74eff60
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4132

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\01edac8cae020cd42786e051ebe37b67_6833eb7b-8d4b-4cdd-9502-9bbf7fc1cf9f
Filesize
50B

MD5
5f22af36aff2e43cacf9a56ba4166900

SHA1
914ede992f5edd5523a3a127a88f7bca60c69665

SHA256
e0671a7dbf4fca7d937ff1300471c5823a57786710faba9f85daf9e843281e3a

SHA512
f7fd666c6dcdae2bf235bb2b00791cf00519579e3181e5e3fd67e70c9a4027d48335b6498f6116efa5e513b7750b0eebeb484a63555d277939923bb48d4f3bc8

Download Submit
memory/2440-6-0x0000000000630000-0x0000000000647000-memory.dmp

Filesize
92KB

Download
memory/2440-17-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3164-0-0x00000000020C0000-0x00000000020D7000-memory.dmp

Filesize
92KB

Download
memory/3164-5-0x00000000006F0000-0x0000000000701000-memory.dmp

Filesize
68KB

Download
memory/4132-19-0x0000000000FB0000-0x0000000000FC7000-memory.dmp

Filesize
92KB

Download
memory/4416-12-0x0000000000DC0000-0x0000000000DD7000-memory.dmp

Filesize
92KB

Download