emotet | 6f0c43533bca3f99699a76fcdce14e7a87290aa035e8da9180ffcfb483810e78

General

Target

82fcee092b605521ad84765368975204_JaffaCakes118.exe
Size

240KB
MD5

82fcee092b605521ad84765368975204
SHA1

6c6247c06c4924bb6a3a0745551a622948fdb35e
SHA256

6f0c43533bca3f99699a76fcdce14e7a87290aa035e8da9180ffcfb483810e78
SHA512

8dc9755d7d81f9c14c3a5abafc38f3bc405940ca6ee94ed48a0bed1c6bdb46056f004f4a728ad333afbab1bc030cad59e1bc83a6b41a87477db65cc437865897
SSDEEP

6144:s7lDAB0NEKts6sUnmWpe6vTgJQ/5867T3EovpVAN9DaYVEuBOCBuWNmT2KIZOi7e:0l0B0WKtsnWprTV

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

190.217.1.149:80

154.120.227.206:8080

45.56.79.249:443

163.172.40.218:7080

79.143.182.254:8080

190.230.60.129:8080

46.28.111.142:7080

190.182.161.7:8080

186.68.141.218:80

201.163.74.202:443

62.75.143.100:7080

200.57.102.71:8443

41.75.135.93:7080

119.159.150.176:443

46.41.151.103:8080

178.79.163.131:8080

190.10.194.42:8080

104.131.58.132:8080

200.113.106.18:80

186.15.57.7:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

cableetw.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	cableetw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

cableetw.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BBA010D1-6925-4011-A9BE-2F3BBC9AB011}\52-a4-6c-d2-f4-72	cableetw.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	cableetw.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	cableetw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0026000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	cableetw.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BBA010D1-6925-4011-A9BE-2F3BBC9AB011}\WpadDecisionReason = "1"	cableetw.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BBA010D1-6925-4011-A9BE-2F3BBC9AB011}\WpadDecision = "0"	cableetw.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BBA010D1-6925-4011-A9BE-2F3BBC9AB011}\WpadNetworkName = "Network 3"	cableetw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-a4-6c-d2-f4-72	cableetw.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-a4-6c-d2-f4-72\WpadDecisionReason = "1"	cableetw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	cableetw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	cableetw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	cableetw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	cableetw.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	cableetw.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	cableetw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BBA010D1-6925-4011-A9BE-2F3BBC9AB011}	cableetw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BBA010D1-6925-4011-A9BE-2F3BBC9AB011}\WpadDecisionTime = 50104b1547b2da01	cableetw.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-a4-6c-d2-f4-72\WpadDecision = "0"	cableetw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	cableetw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	cableetw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-a4-6c-d2-f4-72\WpadDecisionTime = 50104b1547b2da01	cableetw.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

cableetw.exe

pid process

2828 cableetw.exe
2828 cableetw.exe
2828 cableetw.exe
2828 cableetw.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

82fcee092b605521ad84765368975204_JaffaCakes118.exe

pid process

2960 82fcee092b605521ad84765368975204_JaffaCakes118.exe

pid	process
2828	cableetw.exe
2828	cableetw.exe
2828	cableetw.exe
2828	cableetw.exe

pid	process
2960	82fcee092b605521ad84765368975204_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

82fcee092b605521ad84765368975204_JaffaCakes118.execableetw.exe

description	pid	process	target process
PID 2284 wrote to memory of 2960	2284	82fcee092b605521ad84765368975204_JaffaCakes118.exe	82fcee092b605521ad84765368975204_JaffaCakes118.exe
PID 2284 wrote to memory of 2960	2284	82fcee092b605521ad84765368975204_JaffaCakes118.exe	82fcee092b605521ad84765368975204_JaffaCakes118.exe
PID 2284 wrote to memory of 2960	2284	82fcee092b605521ad84765368975204_JaffaCakes118.exe	82fcee092b605521ad84765368975204_JaffaCakes118.exe
PID 2284 wrote to memory of 2960	2284	82fcee092b605521ad84765368975204_JaffaCakes118.exe	82fcee092b605521ad84765368975204_JaffaCakes118.exe
PID 2640 wrote to memory of 2828	2640	cableetw.exe	cableetw.exe
PID 2640 wrote to memory of 2828	2640	cableetw.exe	cableetw.exe
PID 2640 wrote to memory of 2828	2640	cableetw.exe	cableetw.exe
PID 2640 wrote to memory of 2828	2640	cableetw.exe	cableetw.exe

C:\Users\Admin\AppData\Local\Temp\82fcee092b605521ad84765368975204_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\82fcee092b605521ad84765368975204_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Users\Admin\AppData\Local\Temp\82fcee092b605521ad84765368975204_JaffaCakes118.exe
  --b4d2a7f2
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2960

C:\Windows\SysWOW64\cableetw.exe
"C:\Windows\SysWOW64\cableetw.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\cableetw.exe
  --bd7c679d
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2284-6-0x0000000000320000-0x0000000000331000-memory.dmp

Filesize
68KB

Download
memory/2284-0-0x0000000000340000-0x0000000000357000-memory.dmp

Filesize
92KB

Download
memory/2284-5-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2640-12-0x0000000000E40000-0x0000000000E57000-memory.dmp

Filesize
92KB

Download
memory/2640-17-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2828-19-0x0000000000620000-0x0000000000637000-memory.dmp

Filesize
92KB

Download
memory/2828-24-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2960-7-0x00000000003C0000-0x00000000003D7000-memory.dmp

Filesize
92KB

Download
memory/2960-18-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads