emotet | 7f7af11a1a09b65eb3887a93e272eeacfb272781b9e0b7cdf73eacffc080e44e

General

Target
ad0dcae8dcdf3c9cb81c841c198629df_JaffaCakes118.exe
Size 304KB
Sample240615-ghf65azfrb
SHA256 7f7af11a1a09b65eb3887a93e272eeacfb272781b9e0b7cdf73eacffc080e44e
MD5 ad0dcae8dcdf3c9cb81c841c198629df
SHA1 7f148db4ec7d72b621efc16228c054284b4c769a
SHA512 ee247112f619ba26e04822f249ce3986c1d4eaaee4536616ef1135a430c169838cb6cac7176a0130e8999e90caf79bb7349bfb95f7bd0832af47f5476a9ca912
SSDEEP 3072:lFzbgpwAtJ+VOM4X9GLpamAfjs8vGx8/lVtukLrCvQZJt54vtavDsye0hi:lRbgpwAtwIz8L6sk3CvQZSQDuui
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

76.168.54.203:80
51.38.124.206:80
38.88.126.202:8080
54.37.42.48:8080
5.196.35.138:7080
177.129.17.170:443
87.106.46.107:8080
68.183.190.199:8080
185.183.16.47:80
186.103.141.250:443
64.201.88.132:80
70.32.84.74:8080
68.69.155.181:80
82.76.111.249:443
111.67.12.221:8080
60.93.23.51:80
104.131.41.185:8080
92.24.50.153:80
191.182.6.118:80
61.197.92.216:80
213.197.182.158:8080
137.74.106.111:7080
138.97.60.141:7080
187.162.248.237:80
110.142.219.51:80
51.159.23.217:443
192.241.143.52:8080
190.24.243.186:80
51.255.165.160:8080
212.71.237.140:8080
190.115.18.139:8080
174.113.69.136:80
178.250.54.208:8080
190.2.31.172:80
45.16.226.117:443
50.121.220.50:80
217.13.106.14:8080
217.199.160.224:7080
80.11.164.185:80
172.104.169.32:8080
77.90.136.129:8080
123.51.47.18:80
82.230.1.24:80
74.58.215.226:80
185.94.252.27:443
181.30.61.163:443
111.67.77.202:8080
96.227.52.8:443
2.36.95.106:80
78.249.119.122:80
209.236.123.42:8080
185.215.227.107:443
188.135.15.49:80
83.169.21.32:7080
96.245.123.149:80
216.47.196.104:80
50.28.51.143:8080
5.189.178.202:8080
74.136.144.133:80
72.47.248.48:7080
190.190.148.27:8080
189.2.177.210:443
98.13.75.196:80
185.178.10.77:80
181.129.96.162:8080
67.247.242.247:80
170.81.48.2:80
199.203.62.165:80
204.225.249.100:7080
77.106.157.34:8080
68.183.170.114:8080
45.46.37.97:80
70.32.115.157:8080
190.163.31.26:80
94.176.234.118:443
95.9.180.128:80
104.131.103.37:8080
35.143.99.174:80
91.105.94.200:80
190.6.193.152:8080
155.186.0.121:80
219.92.13.25:80
12.162.84.2:8080
220.109.145.69:80
177.74.228.34:80
77.238.212.227:80
61.92.159.208:8080
186.70.127.199:8090
45.33.77.42:8080
152.169.22.67:80
192.241.146.84:8080
185.94.252.12:80
177.73.0.98:443
65.36.62.20:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet payload 4 IoCs

Detects Emotet payload in memory.

trojan banker

resource	yara_rule
behavioral2/memory/5072-0-0x00000000005D0000-0x00000000005E2000-memory.dmp	emotet
behavioral2/memory/5072-4-0x00000000005F0000-0x0000000000600000-memory.dmp	emotet
behavioral2/memory/3456-15-0x00000000020E0000-0x00000000020F0000-memory.dmp	emotet
behavioral2/memory/3456-11-0x00000000020C0000-0x00000000020D2000-memory.dmp	emotet

Executes dropped EXE 1 IoCs

pid	Process
3456	wsmplpxy.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wmiclnt\wsmplpxy.exe	ad0dcae8dcdf3c9cb81c841c198629df_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3456	wsmplpxy.exe
3456	wsmplpxy.exe
3456	wsmplpxy.exe
3456	wsmplpxy.exe
3456	wsmplpxy.exe
3456	wsmplpxy.exe
3456	wsmplpxy.exe
3456	wsmplpxy.exe
3456	wsmplpxy.exe
3456	wsmplpxy.exe
3456	wsmplpxy.exe
3456	wsmplpxy.exe
3456	wsmplpxy.exe
3456	wsmplpxy.exe
3456	wsmplpxy.exe
3456	wsmplpxy.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5072	ad0dcae8dcdf3c9cb81c841c198629df_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 3456	5072	ad0dcae8dcdf3c9cb81c841c198629df_JaffaCakes118.exe	85
PID 5072 wrote to memory of 3456	5072	ad0dcae8dcdf3c9cb81c841c198629df_JaffaCakes118.exe	85
PID 5072 wrote to memory of 3456	5072	ad0dcae8dcdf3c9cb81c841c198629df_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\ad0dcae8dcdf3c9cb81c841c198629df_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ad0dcae8dcdf3c9cb81c841c198629df_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SysWOW64\wmiclnt\wsmplpxy.exe
  "C:\Windows\SysWOW64\wmiclnt\wsmplpxy.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wsmplpxy.exe

Path C:\Windows\SysWOW64\wmiclnt\wsmplpxy.exe
Size 304KB
SHA256 7f7af11a1a09b65eb3887a93e272eeacfb272781b9e0b7cdf73eacffc080e44e
MD5 ad0dcae8dcdf3c9cb81c841c198629df
SHA1 7f148db4ec7d72b621efc16228c054284b4c769a
SHA512 ee247112f619ba26e04822f249ce3986c1d4eaaee4536616ef1135a430c169838cb6cac7176a0130e8999e90caf79bb7349bfb95f7bd0832af47f5476a9ca912
SSDEEP 3072:lFzbgpwAtJ+VOM4X9GLpamAfjs8vGx8/lVtukLrCvQZJt54vtavDsye0hi:lRbgpwAtwIz8L6sk3CvQZSQDuui
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3456-15-0x00000000020E0000-0x00000000020F0000-memory.dmp

Download

memory/3456-11-0x00000000020C0000-0x00000000020D2000-memory.dmp

Download

memory/3456-19-0x00007FFCC9890000-0x00007FFCC9A85000-memory.dmp

Download

memory/3456-20-0x00007FFCC9890000-0x00007FFCC9A85000-memory.dmp

Download

memory/5072-0-0x00000000005D0000-0x00000000005E2000-memory.dmp

Download

memory/5072-4-0x00000000005F0000-0x0000000000600000-memory.dmp

Download

memory/5072-7-0x00007FFCC9890000-0x00007FFCC9A85000-memory.dmp

Download

memory/5072-9-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/5072-10-0x00007FFCC9890000-0x00007FFCC9A85000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads