emotet | 504e5e714fdf10d57faab25f4113879e7565a91afdad4b05cc20bd568a1fba4a

General

Target
94cc0516d4f20560d6ed793050b67059_JaffaCakes118.exe
Size 160KB
Sample240604-pdagsagb65
SHA256 504e5e714fdf10d57faab25f4113879e7565a91afdad4b05cc20bd568a1fba4a
MD5 94cc0516d4f20560d6ed793050b67059
SHA1 ebdd18f2e1c4339d59bb2ecb29e9a837915389d7
SHA512 926464e5a1f5fb78f50d1687475d61575dc5e7bd6c38b785ac5a8b369dbb563e03af1b47bd2c382bd9612ca09a13ba703a931824f8756ef0670f53400d1a3823
SSDEEP 3072:vE2Ryx362Fl1yCo85O1r56elfhVtCWwqj1aURHdLtFvhqD:rRt2TDI1dbtCfqj1aA9xRhqD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

65.23.154.17:8080
144.76.56.36:8080
78.47.106.72:8080
178.79.161.166:443
192.241.220.155:8080
37.157.194.134:443
165.227.156.155:443
178.210.51.222:8080
5.196.74.210:8080
186.4.172.5:8080
45.33.49.124:443
91.205.215.66:8080
78.24.219.147:8080
46.105.131.87:80
149.202.153.252:8080
85.104.59.244:20
186.4.172.5:443
103.39.131.88:80
83.136.245.190:8080
169.239.182.217:8080
62.75.187.192:8080
104.236.246.93:8080
104.131.11.150:8080
87.106.136.232:8080
167.99.105.223:7080
67.225.179.64:8080
104.131.44.150:8080
94.205.247.10:80
190.226.44.20:21
92.222.216.44:8080
190.145.67.134:8090
183.102.238.69:465
217.160.182.191:8080
86.98.64.189:443
181.143.194.138:443
104.239.175.211:8080
87.106.139.101:8080
59.103.164.174:80
31.172.240.91:8080
212.129.24.79:8080
173.212.203.26:8080
182.176.132.213:8090
87.230.19.21:8080
176.31.200.130:8080
144.139.247.220:80
115.78.95.230:443
200.71.148.138:8080
152.89.236.214:8080
211.63.71.72:8080
167.71.10.37:8080
190.53.135.159:21
192.241.255.77:8080
173.249.47.77:8080
37.187.2.199:443
95.128.43.213:8080
186.75.241.230:80
80.11.163.139:21
159.65.25.128:8080
186.4.172.5:20
191.92.209.110:7080
31.12.67.62:7080
181.57.193.14:80
138.201.140.110:8080
192.81.213.192:8080
189.209.217.49:80
190.211.207.11:443
181.31.213.158:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	wrapdispid.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	wrapdispid.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	wrapdispid.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	wrapdispid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	wrapdispid.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	wrapdispid.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	wrapdispid.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1964	wrapdispid.exe
1964	wrapdispid.exe
1964	wrapdispid.exe
1964	wrapdispid.exe
1964	wrapdispid.exe
1964	wrapdispid.exe
1964	wrapdispid.exe
1964	wrapdispid.exe
1964	wrapdispid.exe
1964	wrapdispid.exe
1964	wrapdispid.exe
1964	wrapdispid.exe
1964	wrapdispid.exe
1964	wrapdispid.exe
1964	wrapdispid.exe
1964	wrapdispid.exe
1964	wrapdispid.exe
1964	wrapdispid.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4980	94cc0516d4f20560d6ed793050b67059_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 4980	5024	94cc0516d4f20560d6ed793050b67059_JaffaCakes118.exe	82
PID 5024 wrote to memory of 4980	5024	94cc0516d4f20560d6ed793050b67059_JaffaCakes118.exe	82
PID 5024 wrote to memory of 4980	5024	94cc0516d4f20560d6ed793050b67059_JaffaCakes118.exe	82
PID 2400 wrote to memory of 1964	2400	wrapdispid.exe	92
PID 2400 wrote to memory of 1964	2400	wrapdispid.exe	92
PID 2400 wrote to memory of 1964	2400	wrapdispid.exe	92

C:\Users\Admin\AppData\Local\Temp\94cc0516d4f20560d6ed793050b67059_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\94cc0516d4f20560d6ed793050b67059_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Users\Admin\AppData\Local\Temp\94cc0516d4f20560d6ed793050b67059_JaffaCakes118.exe
  --e4f4c808
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4980

C:\Windows\SysWOW64\wrapdispid.exe
"C:\Windows\SysWOW64\wrapdispid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\wrapdispid.exe
  --5bfc8a19
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4bd2907d2e0afb20e1193e2292377f44_a47c70d8-7adc-4ad7-994f-644a8c84c176

Path C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\4bd2907d2e0afb20e1193e2292377f44_a47c70d8-7adc-4ad7-994f-644a8c84c176
Size 50B
SHA256 b4c777ec60d20aced83997482ad62fa0482734cffa67f4a5bf327f5c15d93ae0
MD5 531d9bc2297289ce9b2144d0e78e77d8
SHA1 e69557ab8db39ceea4557d322cab2ce8f4b61888
SHA512 4bd8bffea131b8b5302ffba45bf651aba71a6235bff78c08b5bad78ebe88794cba13bb6712411764b7c0e821ecca4283862dc8b243eda25f6966c3b6292df636
MD5 SHA1 SHA512

Submit Download

memory/1964-18-0x00000000005A0000-0x00000000005B5000-memory.dmp

Download

memory/2400-12-0x0000000000D60000-0x0000000000D75000-memory.dmp

Download

memory/4980-23-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5024-0-0x0000000002040000-0x0000000002055000-memory.dmp

Download

memory/5024-5-0x0000000000480000-0x0000000000490000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads