emotet | 82fd827a828f7eb4c9683707910a8f4d135c7f2107c33dd94196a09a92e31898

General

Target
7625b18518f0ff9b42b4d95b93cc5d82_JaffaCakes118.exe
Size 652KB
Sample240526-vdflpadb8w
SHA256 82fd827a828f7eb4c9683707910a8f4d135c7f2107c33dd94196a09a92e31898
MD5 7625b18518f0ff9b42b4d95b93cc5d82
SHA1 2ac608221610e1e3bbdf28a60ac9cac798604798
SHA512 2bd93eaa1f8835496919d9b5f0cec0e1c0bd63f7d58b59a92778af721cc9005b741ae99426232232bc5d141cd11f9b9d7574c90d7904a3b595c15043df7ea2ba
SSDEEP 6144:M1kldizdOT/pS0MIt7YRU6f5+StXzXYbnnuCYUvaJqqjbGdIBJxmA++j90TTofwz:VplfofXYbjYUvaVaCn++O4ZV4o6L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch3 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

72.69.99.47:80
190.5.162.204:80
123.142.37.165:80
50.63.13.135:8080
222.239.249.166:443
192.161.190.171:8080
80.93.48.49:7080
195.201.56.68:7080
181.44.166.242:80
161.18.233.114:80
51.38.134.203:8080
212.129.14.27:8080
172.90.70.168:443
45.129.121.222:443
189.180.105.125:443
186.66.224.182:990
122.11.164.183:80
138.197.140.163:8080
211.218.105.101:80
212.112.113.235:80
46.105.131.68:8080
78.46.87.133:8080
124.150.175.133:80
177.226.25.78:80
95.216.212.157:8080
83.99.211.160:80
192.241.220.183:8080
37.59.24.25:8080
50.116.78.109:8080
119.159.150.176:443
190.189.79.73:80
187.250.92.82:80
187.233.220.93:443
143.95.101.72:8080
172.245.13.50:8080
186.215.101.106:80
163.172.97.112:8080
23.253.207.142:8080
41.218.118.66:80
201.183.251.100:80
113.52.135.33:7080
139.162.185.116:443
176.58.93.123:80
182.176.116.139:995
152.169.32.143:8080
162.144.46.90:8080
60.53.3.153:8080
197.90.159.42:80
191.100.24.201:50000
95.216.207.86:7080
181.47.235.26:993
177.103.201.23:80
142.93.87.198:8080
124.150.175.129:8080
46.17.6.116:8080
172.104.70.207:8080
85.105.183.228:443
200.71.112.158:53
81.213.145.45:443
190.101.87.170:80
187.177.155.123:990
83.110.107.243:443
188.230.134.205:80
198.57.217.170:8080
201.196.15.79:990
189.236.4.214:443
5.189.148.98:8080
72.27.212.209:8080
195.191.107.67:80
157.7.164.178:8081
216.75.37.196:8080
181.197.108.171:443
192.163.221.191:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	halwrap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	halwrap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	halwrap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	halwrap.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	halwrap.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	halwrap.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	halwrap.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3440	halwrap.exe
3440	halwrap.exe
3440	halwrap.exe
3440	halwrap.exe
3440	halwrap.exe
3440	halwrap.exe
3440	halwrap.exe
3440	halwrap.exe
3440	halwrap.exe
3440	halwrap.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1920	7625b18518f0ff9b42b4d95b93cc5d82_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4284	7625b18518f0ff9b42b4d95b93cc5d82_JaffaCakes118.exe
1920	7625b18518f0ff9b42b4d95b93cc5d82_JaffaCakes118.exe
4116	halwrap.exe
3440	halwrap.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 1920	4284	7625b18518f0ff9b42b4d95b93cc5d82_JaffaCakes118.exe	85
PID 4284 wrote to memory of 1920	4284	7625b18518f0ff9b42b4d95b93cc5d82_JaffaCakes118.exe	85
PID 4284 wrote to memory of 1920	4284	7625b18518f0ff9b42b4d95b93cc5d82_JaffaCakes118.exe	85
PID 4116 wrote to memory of 3440	4116	halwrap.exe	93
PID 4116 wrote to memory of 3440	4116	halwrap.exe	93
PID 4116 wrote to memory of 3440	4116	halwrap.exe	93

C:\Users\Admin\AppData\Local\Temp\7625b18518f0ff9b42b4d95b93cc5d82_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7625b18518f0ff9b42b4d95b93cc5d82_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Users\Admin\AppData\Local\Temp\7625b18518f0ff9b42b4d95b93cc5d82_JaffaCakes118.exe
  --d5592189
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  PID:1920

C:\Windows\SysWOW64\halwrap.exe
"C:\Windows\SysWOW64\halwrap.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\SysWOW64\halwrap.exe
  --55204bf3
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

01edac8cae020cd42786e051ebe37b67_6833eb7b-8d4b-4cdd-9502-9bbf7fc1cf9f

Path C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\01edac8cae020cd42786e051ebe37b67_6833eb7b-8d4b-4cdd-9502-9bbf7fc1cf9f
Size 50B
SHA256 e0671a7dbf4fca7d937ff1300471c5823a57786710faba9f85daf9e843281e3a
MD5 5f22af36aff2e43cacf9a56ba4166900
SHA1 914ede992f5edd5523a3a127a88f7bca60c69665
SHA512 f7fd666c6dcdae2bf235bb2b00791cf00519579e3181e5e3fd67e70c9a4027d48335b6498f6116efa5e513b7750b0eebeb484a63555d277939923bb48d4f3bc8
MD5 SHA1 SHA512

Submit Download

memory/1920-6-0x00000000007B0000-0x00000000007C7000-memory.dmp

Download

memory/1920-17-0x0000000000400000-0x00000000004A7000-memory.dmp

Download

memory/3440-19-0x0000000000DB0000-0x0000000000DC7000-memory.dmp

Download

memory/4116-12-0x0000000000EB0000-0x0000000000EC7000-memory.dmp

Download

memory/4284-0-0x0000000002120000-0x0000000002137000-memory.dmp

Download

memory/4284-5-0x0000000000760000-0x0000000000771000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads