emotet | 04250419210664c7faa1e2b5cac77fe44a822ef0a306aae7fbafdfabd3c0e562

General

Target

6d4100435ea06df721101446308b4570_JaffaCakes118.exe
Size

364KB
MD5

6d4100435ea06df721101446308b4570
SHA1

3e64ed663205449eea018dc60c7f589acb6829ca
SHA256

04250419210664c7faa1e2b5cac77fe44a822ef0a306aae7fbafdfabd3c0e562
SHA512

7cfc308a6a21165aac8bdce920f9472fa10fc4d83cdd3797be8089ab820031ce302bb48086120a36ff4fd12d231233ebfd7ffa044a812813bf18f812aaa524fd
SSDEEP

6144:By2JRLj6K2gxsKRTVJO/W5TXfU4qHFDbTebas8PZRwBMj:BLJpj6UxTV8/+f0lLUS

Score

10^/10

emotet epoch3 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

54.38.94.197:8080

192.161.190.171:8080

80.93.48.49:7080

222.239.249.166:443

195.226.144.249:80

216.75.37.196:8080

192.163.221.191:8080

200.71.112.158:53

119.159.150.176:443

113.52.135.33:7080

50.116.78.109:8080

124.150.175.133:80

139.162.185.116:443

124.150.175.129:8080

157.7.164.178:8081

37.59.24.25:8080

51.38.134.203:8080

217.26.163.82:7080

172.104.70.207:8080

201.196.15.79:990

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

printmore.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	printmore.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 25 IoCs

Processes:

printmore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-65-03-b4-91-1c\WpadDecision = "0"	printmore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4F2FB857-DF5B-42AC-9ECD-434BB9D75853}	printmore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4F2FB857-DF5B-42AC-9ECD-434BB9D75853}\WpadDecisionReason = "1"	printmore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	printmore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4F2FB857-DF5B-42AC-9ECD-434BB9D75853}\8e-65-03-b4-91-1c	printmore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	printmore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-65-03-b4-91-1c\WpadDecisionTime = 0051e1dd8dadda01	printmore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	printmore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-65-03-b4-91-1c	printmore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	printmore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	printmore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f009b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	printmore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-65-03-b4-91-1c\WpadDetectedUrl	printmore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f009b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	printmore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4F2FB857-DF5B-42AC-9ECD-434BB9D75853}\WpadDecisionTime = 0051e1dd8dadda01	printmore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	printmore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	printmore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4F2FB857-DF5B-42AC-9ECD-434BB9D75853}\WpadDecisionTime = 604404a48dadda01	printmore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4F2FB857-DF5B-42AC-9ECD-434BB9D75853}\WpadDecision = "0"	printmore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-65-03-b4-91-1c\WpadDecisionTime = 604404a48dadda01	printmore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	printmore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	printmore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4F2FB857-DF5B-42AC-9ECD-434BB9D75853}\WpadNetworkName = "Network 3"	printmore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-65-03-b4-91-1c\WpadDecisionReason = "1"	printmore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	printmore.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

printmore.exe

pid process

2820 printmore.exe
2820 printmore.exe
2820 printmore.exe
2820 printmore.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

6d4100435ea06df721101446308b4570_JaffaCakes118.exe

pid process

2188 6d4100435ea06df721101446308b4570_JaffaCakes118.exe

pid	process
2820	printmore.exe
2820	printmore.exe
2820	printmore.exe
2820	printmore.exe

pid	process
2188	6d4100435ea06df721101446308b4570_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

6d4100435ea06df721101446308b4570_JaffaCakes118.exe6d4100435ea06df721101446308b4570_JaffaCakes118.exeprintmore.exeprintmore.exe

pid	process
2116	6d4100435ea06df721101446308b4570_JaffaCakes118.exe
2188	6d4100435ea06df721101446308b4570_JaffaCakes118.exe
2304	printmore.exe
2820	printmore.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

6d4100435ea06df721101446308b4570_JaffaCakes118.exeprintmore.exe

description	pid	process	target process
PID 2116 wrote to memory of 2188	2116	6d4100435ea06df721101446308b4570_JaffaCakes118.exe	6d4100435ea06df721101446308b4570_JaffaCakes118.exe
PID 2116 wrote to memory of 2188	2116	6d4100435ea06df721101446308b4570_JaffaCakes118.exe	6d4100435ea06df721101446308b4570_JaffaCakes118.exe
PID 2116 wrote to memory of 2188	2116	6d4100435ea06df721101446308b4570_JaffaCakes118.exe	6d4100435ea06df721101446308b4570_JaffaCakes118.exe
PID 2116 wrote to memory of 2188	2116	6d4100435ea06df721101446308b4570_JaffaCakes118.exe	6d4100435ea06df721101446308b4570_JaffaCakes118.exe
PID 2304 wrote to memory of 2820	2304	printmore.exe	printmore.exe
PID 2304 wrote to memory of 2820	2304	printmore.exe	printmore.exe
PID 2304 wrote to memory of 2820	2304	printmore.exe	printmore.exe
PID 2304 wrote to memory of 2820	2304	printmore.exe	printmore.exe

C:\Users\Admin\AppData\Local\Temp\6d4100435ea06df721101446308b4570_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6d4100435ea06df721101446308b4570_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116

C:\Users\Admin\AppData\Local\Temp\6d4100435ea06df721101446308b4570_JaffaCakes118.exe
--53d0e058
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2188

C:\Windows\SysWOW64\printmore.exe
"C:\Windows\SysWOW64\printmore.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304

C:\Windows\SysWOW64\printmore.exe
--e4b86a58
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2820

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2116-5-0x00000000002A0000-0x00000000002B1000-memory.dmp

Filesize
68KB

Download
memory/2116-0-0x00000000002C0000-0x00000000002D7000-memory.dmp

Filesize
92KB

Download
memory/2188-6-0x0000000000460000-0x0000000000477000-memory.dmp

Filesize
92KB

Download
memory/2188-16-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2304-11-0x0000000000520000-0x0000000000537000-memory.dmp

Filesize
92KB

Download
memory/2820-17-0x00000000003E0000-0x00000000003F7000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads