emotet | 195857546e3488d033407e7e2e0c10b01c4b535f99362684b27cad7965ec7d50

General

Target
8d4134823512a96c88fde20832ea4c2a_JaffaCakes118.exe
Size 640KB
Sample240602-hwr18aed6v
SHA256 195857546e3488d033407e7e2e0c10b01c4b535f99362684b27cad7965ec7d50
MD5 8d4134823512a96c88fde20832ea4c2a
SHA1 ef359c134ca0b3eec0030b89832b0a77bbfbf868
SHA512 78688593773c349133c0353bc67911cf9366b8ef54d528459836e38e9ad935093df48e3382b8e42d07e9148cf931445ea378c97f1786dd7041ec626c302b8516
SSDEEP 12288:UphSRoPQfYGRWDr/ZxQko0WYNkjChkljXjj8AXH:UHL6WDDWY6FjzI+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

104.236.137.72:8080
172.104.233.225:8080
213.189.36.51:8080
85.234.143.94:8080
186.23.132.93:990
142.127.57.63:8080
149.62.173.247:8080
86.42.166.147:80
181.36.42.205:443
201.190.133.235:8080
88.250.223.190:8080
181.231.62.54:80
190.146.131.105:8080
200.123.101.90:80
212.71.237.140:8080
187.230.99.192:443
190.17.42.79:80
119.59.124.163:8080
86.142.102.191:8443
203.130.0.69:80
77.55.211.77:8080
46.101.212.195:8080
82.196.15.205:8080
139.5.237.27:443
190.16.101.10:80
91.205.215.57:7080
45.79.95.107:443
50.28.51.143:8080
186.15.83.52:8080
189.173.113.67:443
46.28.111.142:7080
186.0.68.43:8443
186.1.41.111:443
109.169.86.13:8080
142.93.114.137:8080
190.4.50.26:80
80.85.87.122:8080
207.154.204.40:8080
14.160.93.230:80
217.199.160.224:8080
189.139.35.247:8443
201.213.32.59:80
178.79.163.131:8080
181.61.143.177:80
87.106.77.40:7080
200.113.106.18:80
190.102.226.91:80
187.190.49.92:443
62.75.160.178:8080
138.68.106.4:7080
185.86.148.222:8080
69.163.33.84:8080
190.97.30.167:990
200.58.83.179:80
51.255.165.160:8080
154.120.227.206:8080
186.137.112.214:80
68.183.170.114:8080
134.209.214.126:8080
201.163.74.202:443
183.82.97.25:80
190.195.129.227:8090
91.83.93.124:7080
181.135.153.203:443
96.20.84.254:7080
81.213.215.216:50000
159.203.204.126:8080
5.196.35.138:7080
190.38.14.52:80
91.204.163.19:8090
203.25.159.3:8080
181.16.17.210:443
87.118.70.69:8080
94.183.71.206:7080
92.169.250.229:8080
68.183.190.199:8080
182.48.194.6:8090
163.172.40.218:7080
125.99.61.162:7080
104.131.58.132:8080
62.75.143.100:7080
190.210.184.138:995
181.198.203.45:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	stuckchar.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	stuckchar.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	stuckchar.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	stuckchar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	stuckchar.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	stuckchar.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	stuckchar.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3204	stuckchar.exe
3204	stuckchar.exe
3204	stuckchar.exe
3204	stuckchar.exe
3204	stuckchar.exe
3204	stuckchar.exe
3204	stuckchar.exe
3204	stuckchar.exe
3204	stuckchar.exe
3204	stuckchar.exe
3204	stuckchar.exe
3204	stuckchar.exe
3204	stuckchar.exe
3204	stuckchar.exe
3204	stuckchar.exe
3204	stuckchar.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4488	8d4134823512a96c88fde20832ea4c2a_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3440	8d4134823512a96c88fde20832ea4c2a_JaffaCakes118.exe
4488	8d4134823512a96c88fde20832ea4c2a_JaffaCakes118.exe
1324	stuckchar.exe
3204	stuckchar.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 4488	3440	8d4134823512a96c88fde20832ea4c2a_JaffaCakes118.exe	86
PID 3440 wrote to memory of 4488	3440	8d4134823512a96c88fde20832ea4c2a_JaffaCakes118.exe	86
PID 3440 wrote to memory of 4488	3440	8d4134823512a96c88fde20832ea4c2a_JaffaCakes118.exe	86
PID 1324 wrote to memory of 3204	1324	stuckchar.exe	98
PID 1324 wrote to memory of 3204	1324	stuckchar.exe	98
PID 1324 wrote to memory of 3204	1324	stuckchar.exe	98

C:\Users\Admin\AppData\Local\Temp\8d4134823512a96c88fde20832ea4c2a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8d4134823512a96c88fde20832ea4c2a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Users\Admin\AppData\Local\Temp\8d4134823512a96c88fde20832ea4c2a_JaffaCakes118.exe
  --e4cbcea4
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  PID:4488

C:\Windows\SysWOW64\stuckchar.exe
"C:\Windows\SysWOW64\stuckchar.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\stuckchar.exe
  --e9406908
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5847f796e40b24ab4b196e9bf5777c79_5a32ead2-14a8-4b34-b6a3-85cfb28e2fbd

Path C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\5847f796e40b24ab4b196e9bf5777c79_5a32ead2-14a8-4b34-b6a3-85cfb28e2fbd
Size 50B
SHA256 e4727b1d8ab8799bf1b4bb1e93e89482f1a6a6a890d8ef894c1b966168422de9
MD5 c14842e691d2aa61b9d595e1be388f4d
SHA1 f7c1944b8c0d66b7e946fa9f203d6c2e8ff40725
SHA512 2c9406f1c18d6518bc7c6f59e5f6cdc284e4858ccdc3c47bcbe56c43e16977305bb2c21b4e0ec43a072429bfb66a20af342b6197b678f606f61a6f779c6ccce6
MD5 SHA1 SHA512

Submit Download

memory/1324-12-0x0000000000F90000-0x0000000000FA7000-memory.dmp

Download

memory/3204-19-0x0000000000EA0000-0x0000000000EB7000-memory.dmp

Download

memory/3440-5-0x0000000000660000-0x0000000000671000-memory.dmp

Download

memory/3440-0-0x0000000000680000-0x0000000000697000-memory.dmp

Download

memory/4488-6-0x0000000002120000-0x0000000002137000-memory.dmp

Download

memory/4488-18-0x0000000000400000-0x00000000004A5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads