emotet | 6f0c43533bca3f99699a76fcdce14e7a87290aa035e8da9180ffcfb483810e78

General

Target
82fcee092b605521ad84765368975204_JaffaCakes118.exe
Size 240KB
Sample240530-eqexxseh86
SHA256 6f0c43533bca3f99699a76fcdce14e7a87290aa035e8da9180ffcfb483810e78
MD5 82fcee092b605521ad84765368975204
SHA1 6c6247c06c4924bb6a3a0745551a622948fdb35e
SHA512 8dc9755d7d81f9c14c3a5abafc38f3bc405940ca6ee94ed48a0bed1c6bdb46056f004f4a728ad333afbab1bc030cad59e1bc83a6b41a87477db65cc437865897
SSDEEP 6144:s7lDAB0NEKts6sUnmWpe6vTgJQ/5867T3EovpVAN9DaYVEuBOCBuWNmT2KIZOi7e:0l0B0WKtsnWprTV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

190.217.1.149:80
154.120.227.206:8080
45.56.79.249:443
163.172.40.218:7080
79.143.182.254:8080
190.230.60.129:8080
46.28.111.142:7080
190.182.161.7:8080
186.68.141.218:80
201.163.74.202:443
62.75.143.100:7080
200.57.102.71:8443
41.75.135.93:7080
119.159.150.176:443
46.41.151.103:8080
178.79.163.131:8080
190.10.194.42:8080
104.131.58.132:8080
200.113.106.18:80
186.15.57.7:8080
220.241.38.226:50000
77.245.101.134:8080
82.196.15.205:8080
190.96.118.15:443
207.154.204.40:8080
190.104.253.234:990
181.36.42.205:443
190.120.104.21:443
201.184.41.228:990
181.44.166.242:80
183.82.97.25:80
212.71.237.140:8080
190.146.131.105:8080
201.213.32.59:80
200.30.227.135:80
178.249.187.151:8080
94.183.71.206:7080
217.199.160.224:8080
91.205.215.57:7080
190.230.60.129:80
139.5.237.27:443
91.204.163.19:8090
51.15.8.192:8080
94.177.183.28:8080
86.42.166.147:80
144.139.158.155:80
181.59.253.20:21
77.55.211.77:8080
142.93.114.137:8080
190.97.30.167:990
62.75.160.178:8080
80.85.87.122:8080
109.169.86.13:8080
190.38.14.52:80
186.1.41.111:443
138.68.106.4:7080
186.0.95.172:80
45.79.95.107:443
119.59.124.163:8080
68.183.170.114:8080
181.16.17.210:443
14.160.93.230:80
159.203.204.126:8080
201.190.133.235:8080
86.6.188.121:80
46.101.212.195:8080
87.106.77.40:7080
149.62.173.247:8080
89.188.124.145:443
186.23.132.93:990
181.135.153.203:443
69.163.33.84:8080
200.58.83.179:80
185.86.148.222:8080
185.187.198.10:8080
79.127.57.43:80
91.83.93.124:7080
46.29.183.211:8080
50.28.51.143:8080
5.196.35.138:7080
81.169.140.14:443
203.25.159.3:8080
190.85.152.186:8080
68.183.190.199:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	lclterm.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	lclterm.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	lclterm.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	lclterm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	lclterm.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	lclterm.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	lclterm.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1496	lclterm.exe
1496	lclterm.exe
1496	lclterm.exe
1496	lclterm.exe
1496	lclterm.exe
1496	lclterm.exe
1496	lclterm.exe
1496	lclterm.exe
1496	lclterm.exe
1496	lclterm.exe
1496	lclterm.exe
1496	lclterm.exe
1496	lclterm.exe
1496	lclterm.exe
1496	lclterm.exe
1496	lclterm.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1848	82fcee092b605521ad84765368975204_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 1848	2280	82fcee092b605521ad84765368975204_JaffaCakes118.exe	83
PID 2280 wrote to memory of 1848	2280	82fcee092b605521ad84765368975204_JaffaCakes118.exe	83
PID 2280 wrote to memory of 1848	2280	82fcee092b605521ad84765368975204_JaffaCakes118.exe	83
PID 4424 wrote to memory of 1496	4424	lclterm.exe	96
PID 4424 wrote to memory of 1496	4424	lclterm.exe	96
PID 4424 wrote to memory of 1496	4424	lclterm.exe	96

C:\Users\Admin\AppData\Local\Temp\82fcee092b605521ad84765368975204_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\82fcee092b605521ad84765368975204_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Local\Temp\82fcee092b605521ad84765368975204_JaffaCakes118.exe
  --b4d2a7f2
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1848

C:\Windows\SysWOW64\lclterm.exe
"C:\Windows\SysWOW64\lclterm.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\SysWOW64\lclterm.exe
  --35fb2cd7
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

151006038beb3d5e9a4e1db2e6315db6_310807ab-751f-4d81-ae09-b202eaf21e19

Path C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\151006038beb3d5e9a4e1db2e6315db6_310807ab-751f-4d81-ae09-b202eaf21e19
Size 50B
SHA256 a2291a4fcb3343cdfad5d198bdc7dd62af09605c264681fa26ed79cecb53c01e
MD5 2219ed8c4461bbee47dc0ac045013700
SHA1 f537ff444a352845422abf004e0087645f903a44
SHA512 74026b6cb0f530e6acc0681ac68b990ca68f7baca7244b2954799b3556ee98c88f8d63092863cd391d1851b6e10795f54252da34a5d25da3911779891f8cb822
MD5 SHA1 SHA512

Submit Download

memory/1496-21-0x0000000000700000-0x0000000000717000-memory.dmp

Download

memory/1496-26-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/1848-7-0x0000000000810000-0x0000000000827000-memory.dmp

Download

memory/1848-19-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2280-0-0x00000000006B0000-0x00000000006C7000-memory.dmp

Download

memory/2280-5-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2280-6-0x0000000000690000-0x00000000006A1000-memory.dmp

Download

memory/4424-13-0x0000000000710000-0x0000000000727000-memory.dmp

Download

memory/4424-18-0x0000000000400000-0x0000000000439000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads