emotet | 04250419210664c7faa1e2b5cac77fe44a822ef0a306aae7fbafdfabd3c0e562

General

Target

6d4100435ea06df721101446308b4570_JaffaCakes118.exe
Size

364KB
MD5

6d4100435ea06df721101446308b4570
SHA1

3e64ed663205449eea018dc60c7f589acb6829ca
SHA256

04250419210664c7faa1e2b5cac77fe44a822ef0a306aae7fbafdfabd3c0e562
SHA512

7cfc308a6a21165aac8bdce920f9472fa10fc4d83cdd3797be8089ab820031ce302bb48086120a36ff4fd12d231233ebfd7ffa044a812813bf18f812aaa524fd
SSDEEP

6144:By2JRLj6K2gxsKRTVJO/W5TXfU4qHFDbTebas8PZRwBMj:BLJpj6UxTV8/+f0lLUS

Score

10^/10

emotet epoch3 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

54.38.94.197:8080

192.161.190.171:8080

80.93.48.49:7080

222.239.249.166:443

195.226.144.249:80

216.75.37.196:8080

192.163.221.191:8080

200.71.112.158:53

119.159.150.176:443

113.52.135.33:7080

50.116.78.109:8080

124.150.175.133:80

139.162.185.116:443

124.150.175.129:8080

157.7.164.178:8081

37.59.24.25:8080

51.38.134.203:8080

217.26.163.82:7080

172.104.70.207:8080

201.196.15.79:990

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

groupmore.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	groupmore.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	groupmore.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	groupmore.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	groupmore.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

groupmore.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	groupmore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	groupmore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	groupmore.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

groupmore.exe

pid	process
3608	groupmore.exe
3608	groupmore.exe
3608	groupmore.exe
3608	groupmore.exe
3608	groupmore.exe
3608	groupmore.exe
3608	groupmore.exe
3608	groupmore.exe
3608	groupmore.exe
3608	groupmore.exe
3608	groupmore.exe
3608	groupmore.exe
3608	groupmore.exe
3608	groupmore.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

6d4100435ea06df721101446308b4570_JaffaCakes118.exe

pid process

2212 6d4100435ea06df721101446308b4570_JaffaCakes118.exe

pid	process
2212	6d4100435ea06df721101446308b4570_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

6d4100435ea06df721101446308b4570_JaffaCakes118.exe6d4100435ea06df721101446308b4570_JaffaCakes118.exegroupmore.exegroupmore.exe

pid	process
4592	6d4100435ea06df721101446308b4570_JaffaCakes118.exe
2212	6d4100435ea06df721101446308b4570_JaffaCakes118.exe
4880	groupmore.exe
3608	groupmore.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

6d4100435ea06df721101446308b4570_JaffaCakes118.exegroupmore.exe

description	pid	process	target process
PID 4592 wrote to memory of 2212	4592	6d4100435ea06df721101446308b4570_JaffaCakes118.exe	6d4100435ea06df721101446308b4570_JaffaCakes118.exe
PID 4592 wrote to memory of 2212	4592	6d4100435ea06df721101446308b4570_JaffaCakes118.exe	6d4100435ea06df721101446308b4570_JaffaCakes118.exe
PID 4592 wrote to memory of 2212	4592	6d4100435ea06df721101446308b4570_JaffaCakes118.exe	6d4100435ea06df721101446308b4570_JaffaCakes118.exe
PID 4880 wrote to memory of 3608	4880	groupmore.exe	groupmore.exe
PID 4880 wrote to memory of 3608	4880	groupmore.exe	groupmore.exe
PID 4880 wrote to memory of 3608	4880	groupmore.exe	groupmore.exe

C:\Users\Admin\AppData\Local\Temp\6d4100435ea06df721101446308b4570_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6d4100435ea06df721101446308b4570_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4592

C:\Users\Admin\AppData\Local\Temp\6d4100435ea06df721101446308b4570_JaffaCakes118.exe
--53d0e058
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2212

C:\Windows\SysWOW64\groupmore.exe
"C:\Windows\SysWOW64\groupmore.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4880

C:\Windows\SysWOW64\groupmore.exe
--a87c8e0a
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3608

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\b41b76628102b84b36367c09999a066a_44d43ff8-91cd-4ca7-92c9-6495b4f546fa
Filesize
50B

MD5
2639b378dbbb419de68ff1e90fba211d

SHA1
de1a6cbd4cde6ff636815485534aa18116d66193

SHA256
939db142a506000d931e41d5642d7a406ecabb849d4b8b969a7abc14ad4d7c7e

SHA512
64baf245c007de421c85176ff1a5639bf7b317ce9b0b0139a4a2e2dec0024048e7bb21c53af40ae354e7ab73ee66acda0431e7af5376c59f63a6faff598c3bd0

Download Submit
memory/2212-6-0x00000000020C0000-0x00000000020D7000-memory.dmp

Filesize
92KB

Download
memory/2212-17-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/3608-19-0x0000000000F80000-0x0000000000F97000-memory.dmp

Filesize
92KB

Download
memory/4592-5-0x0000000002270000-0x0000000002281000-memory.dmp

Filesize
68KB

Download
memory/4592-0-0x0000000002290000-0x00000000022A7000-memory.dmp

Filesize
92KB

Download
memory/4880-12-0x0000000000E00000-0x0000000000E17000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads