emotet | 04250419210664c7faa1e2b5cac77fe44a822ef0a306aae7fbafdfabd3c0e562

General

Target
6d4100435ea06df721101446308b4570_JaffaCakes118.exe
Size 364KB
Sample240524-eed69aca4y
SHA256 04250419210664c7faa1e2b5cac77fe44a822ef0a306aae7fbafdfabd3c0e562
MD5 6d4100435ea06df721101446308b4570
SHA1 3e64ed663205449eea018dc60c7f589acb6829ca
SHA512 7cfc308a6a21165aac8bdce920f9472fa10fc4d83cdd3797be8089ab820031ce302bb48086120a36ff4fd12d231233ebfd7ffa044a812813bf18f812aaa524fd
SSDEEP 6144:By2JRLj6K2gxsKRTVJO/W5TXfU4qHFDbTebas8PZRwBMj:BLJpj6UxTV8/+f0lLUS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch3 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

54.38.94.197:8080
192.161.190.171:8080
80.93.48.49:7080
222.239.249.166:443
195.226.144.249:80
216.75.37.196:8080
192.163.221.191:8080
200.71.112.158:53
119.159.150.176:443
113.52.135.33:7080
50.116.78.109:8080
124.150.175.133:80
139.162.185.116:443
124.150.175.129:8080
157.7.164.178:8081
37.59.24.25:8080
51.38.134.203:8080
217.26.163.82:7080
172.104.70.207:8080
201.196.15.79:990
181.44.166.242:80
162.144.46.90:8080
181.47.235.26:993
46.17.6.116:8080
212.129.14.27:8080
143.95.101.72:8080
142.93.87.198:8080
172.245.13.50:8080
95.216.207.86:7080
95.216.212.157:8080
83.169.33.157:8080
176.58.93.123:80
177.226.25.78:80
198.57.217.170:8080
152.169.32.143:8080
187.177.155.123:990
212.112.113.235:80
190.189.79.73:80
192.241.220.183:8080
186.66.224.182:990
195.201.56.68:7080
163.172.97.112:8080
78.46.87.133:8080
46.105.131.68:8080
23.253.207.142:8080
138.197.140.163:8080
182.176.116.139:995
5.189.148.98:8080
181.197.108.171:443
191.100.24.201:50000

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	groupmore.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	groupmore.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	groupmore.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	groupmore.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	groupmore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	groupmore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	groupmore.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3608	groupmore.exe
3608	groupmore.exe
3608	groupmore.exe
3608	groupmore.exe
3608	groupmore.exe
3608	groupmore.exe
3608	groupmore.exe
3608	groupmore.exe
3608	groupmore.exe
3608	groupmore.exe
3608	groupmore.exe
3608	groupmore.exe
3608	groupmore.exe
3608	groupmore.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2212	6d4100435ea06df721101446308b4570_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4592	6d4100435ea06df721101446308b4570_JaffaCakes118.exe
2212	6d4100435ea06df721101446308b4570_JaffaCakes118.exe
4880	groupmore.exe
3608	groupmore.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 2212	4592	6d4100435ea06df721101446308b4570_JaffaCakes118.exe	86
PID 4592 wrote to memory of 2212	4592	6d4100435ea06df721101446308b4570_JaffaCakes118.exe	86
PID 4592 wrote to memory of 2212	4592	6d4100435ea06df721101446308b4570_JaffaCakes118.exe	86
PID 4880 wrote to memory of 3608	4880	groupmore.exe	97
PID 4880 wrote to memory of 3608	4880	groupmore.exe	97
PID 4880 wrote to memory of 3608	4880	groupmore.exe	97

C:\Users\Admin\AppData\Local\Temp\6d4100435ea06df721101446308b4570_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6d4100435ea06df721101446308b4570_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Users\Admin\AppData\Local\Temp\6d4100435ea06df721101446308b4570_JaffaCakes118.exe
  --53d0e058
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  PID:2212

C:\Windows\SysWOW64\groupmore.exe
"C:\Windows\SysWOW64\groupmore.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\SysWOW64\groupmore.exe
  --a87c8e0a
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b41b76628102b84b36367c09999a066a_44d43ff8-91cd-4ca7-92c9-6495b4f546fa

Path C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\b41b76628102b84b36367c09999a066a_44d43ff8-91cd-4ca7-92c9-6495b4f546fa
Size 50B
SHA256 939db142a506000d931e41d5642d7a406ecabb849d4b8b969a7abc14ad4d7c7e
MD5 2639b378dbbb419de68ff1e90fba211d
SHA1 de1a6cbd4cde6ff636815485534aa18116d66193
SHA512 64baf245c007de421c85176ff1a5639bf7b317ce9b0b0139a4a2e2dec0024048e7bb21c53af40ae354e7ab73ee66acda0431e7af5376c59f63a6faff598c3bd0
MD5 SHA1 SHA512

Submit Download

memory/2212-6-0x00000000020C0000-0x00000000020D7000-memory.dmp

Download

memory/2212-17-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3608-19-0x0000000000F80000-0x0000000000F97000-memory.dmp

Download

memory/4592-5-0x0000000002270000-0x0000000002281000-memory.dmp

Download

memory/4592-0-0x0000000002290000-0x00000000022A7000-memory.dmp

Download

memory/4880-12-0x0000000000E00000-0x0000000000E17000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads