emotet | 7921e0e1f73e08021aa0648c408f236cdc483fb187d19e7a5651c08f05d9dd3b

Analysis

max time kernel
8s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
985799e66581ef777b52da4338130e6c_JaffaCakes118.exe
Size 532KB
Sample240605-rbdsjaaa45
SHA256 7921e0e1f73e08021aa0648c408f236cdc483fb187d19e7a5651c08f05d9dd3b
MD5 985799e66581ef777b52da4338130e6c
SHA1 c9b37102c09db351e30f7dcefedd2821692d7026
SHA512 7035ddfd52ca208a2dd9dfa639756985688b557bd68d89c12e3ee7939102ba8df93e195b35d73cbac0021ff2ef98ed3619dd3a60edb049a5b8fe79fc55f67013
SSDEEP 6144:7hWh0YI1DsdsLZQ+cUZb8XcBhC5Yp9PHS6pKNJJrF+H3lV/+ZDCE6B2Gh/nNfOf8:7he0wsfcU50RAVUPJrFm+kfh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

201.184.105.242:443
24.45.195.162:7080
24.45.195.162:8443
94.192.225.46:80
80.11.163.139:443
133.167.80.63:7080
198.199.114.69:8080
80.79.23.144:443
192.254.173.31:8080
67.225.229.55:8080
190.108.228.48:990
62.75.187.192:8080
185.94.252.13:443
94.205.247.10:80
211.63.71.72:8080
59.103.164.174:80
192.81.213.192:8080
27.4.80.183:443
190.145.67.134:8090
115.78.95.230:443
104.131.11.150:8080
95.128.43.213:8080
212.71.234.16:8080
178.254.6.27:7080
86.98.25.30:53
91.205.215.66:8080
188.166.253.46:8080
80.11.163.139:21
186.75.241.230:80
190.106.97.230:443
78.24.219.147:8080
217.160.182.191:8080
173.212.203.26:8080
92.222.216.44:8080
136.243.177.26:8080
37.157.194.134:443
190.211.207.11:443
104.236.246.93:8080
190.18.146.70:80
103.255.150.84:80
138.201.140.110:8080
41.220.119.246:80
200.71.148.138:8080
85.54.169.141:8080
144.139.247.220:80
149.202.153.252:8080
31.172.240.91:8080
186.4.172.5:443
178.79.161.166:443
186.4.172.5:8080
206.189.98.125:8080
87.106.139.101:8080
46.105.131.87:80
45.123.3.54:443
222.214.218.192:8080
85.106.1.166:50000
83.136.245.190:8080
179.32.19.219:22
152.89.236.214:8080
181.31.213.158:8080
87.106.136.232:8080
47.41.213.2:22
201.251.43.69:8080
24.51.106.145:21
87.230.19.21:8080
190.228.72.244:53
181.143.194.138:443
182.176.106.43:995
31.12.67.62:7080
182.76.6.2:8080
190.226.44.20:21
181.143.53.227:21
189.209.217.49:80
190.186.203.55:80
27.147.163.188:8080
159.65.25.128:8080
101.187.237.217:20
182.176.132.213:8090
199.19.237.192:80
124.240.198.66:80
5.196.74.210:8080
190.53.135.159:21
186.4.172.5:20
45.33.49.124:443
92.233.128.13:143
85.104.59.244:20
169.239.182.217:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications	sizesproc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications\MFCBind	sizesproc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications\MFCBind\Recent File List	sizesproc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications\MFCBind\Settings	sizesproc.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5080	985799e66581ef777b52da4338130e6c_jaffacakes118.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3808	985799e66581ef777b52da4338130e6c_JaffaCakes118.exe
3808	985799e66581ef777b52da4338130e6c_JaffaCakes118.exe
5080	985799e66581ef777b52da4338130e6c_jaffacakes118.exe
5080	985799e66581ef777b52da4338130e6c_jaffacakes118.exe
4840	sizesproc.exe
4840	sizesproc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 5080	3808	985799e66581ef777b52da4338130e6c_JaffaCakes118.exe	86
PID 3808 wrote to memory of 5080	3808	985799e66581ef777b52da4338130e6c_JaffaCakes118.exe	86
PID 3808 wrote to memory of 5080	3808	985799e66581ef777b52da4338130e6c_JaffaCakes118.exe	86
PID 4840 wrote to memory of 5024	4840	sizesproc.exe	93
PID 4840 wrote to memory of 5024	4840	sizesproc.exe	93
PID 4840 wrote to memory of 5024	4840	sizesproc.exe	93

C:\Users\Admin\AppData\Local\Temp\985799e66581ef777b52da4338130e6c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\985799e66581ef777b52da4338130e6c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Users\Admin\AppData\Local\Temp\985799e66581ef777b52da4338130e6c_jaffacakes118.exe
  --949ee264
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  PID:5080

C:\Windows\SysWOW64\sizesproc.exe
"C:\Windows\SysWOW64\sizesproc.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\SysWOW64\sizesproc.exe
  --36afaafe
  2⤵
  PID:5024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3808-5-0x00000000022F0000-0x00000000022FF000-memory.dmp

Download

memory/3808-0-0x0000000002300000-0x0000000002314000-memory.dmp

Download

memory/4840-11-0x0000000000660000-0x0000000000674000-memory.dmp

Download

memory/5024-17-0x0000000000DD0000-0x0000000000DE4000-memory.dmp

Download

memory/5080-6-0x00000000021B0000-0x00000000021C4000-memory.dmp

Download

memory/5080-16-0x0000000000400000-0x0000000000489000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads