emotet | 854e7da2ffe2c9aa706bf7fba31b42138544b2335e76c0c205b57ce95bae80e2

Analysis

max time kernel
134s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 00:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b0cdec47e68ed0ed86889da8292ee1e7_JaffaCakes118.exe
Size 376KB
Sample240616-ab54ca1ajc
SHA256 854e7da2ffe2c9aa706bf7fba31b42138544b2335e76c0c205b57ce95bae80e2
MD5 b0cdec47e68ed0ed86889da8292ee1e7
SHA1 9f8f7380070af99b7a5d6633cea86e151c4758ed
SHA512 0ebbad6ffaec2dc63c3a5f499c5c32a2599790f12a15ace782f144418e7294a4a4032c81166dd6852b1fd5041a0c13421cf917765620ae91217432d242513508
SSDEEP 6144:zWKg4vCS9iocEDzogURsxLPH1wvR19SrIya/35VdRjjhowIIyK:ooc0zogUiZw518rgbvawl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

173.247.19.238:80
174.81.132.128:80
211.44.35.111:80
165.227.156.155:443
167.99.105.223:7080
67.225.179.64:8080
176.31.200.130:8080
104.131.11.150:8080
68.118.26.116:80
190.226.44.20:21
120.150.246.241:80
92.222.216.44:8080
73.214.99.25:80
110.142.38.16:80
24.93.212.32:80
190.53.135.159:21
66.209.97.122:8080
173.91.11.142:80
100.14.117.137:80
2.237.76.249:80
104.137.176.186:80
47.6.15.79:80
62.75.187.192:8080
47.156.70.145:80
201.173.217.124:443
104.131.44.150:8080
186.75.241.230:80
31.131.182.30:80
107.170.24.125:8080
110.143.84.202:80
75.80.148.244:80
186.67.208.78:8080
104.236.246.93:8080
45.51.40.140:80
45.33.49.124:443
74.105.102.97:8080
70.46.247.81:80
59.103.164.174:80
110.143.57.109:80
31.31.77.83:443
192.241.255.77:8080
195.244.215.206:80
144.139.247.220:80
103.86.49.11:8080
61.197.110.214:80
91.242.138.5:443
101.187.134.207:443
73.11.153.178:8080
190.12.119.180:443
5.196.74.210:8080
209.141.54.221:8080
169.239.182.217:8080
2.38.99.79:80
197.254.221.174:80
85.72.180.68:80
179.13.185.19:80
183.102.238.69:465
149.202.153.252:8080
64.53.242.181:8080
2.235.190.23:8080
174.77.190.137:8080
182.176.132.213:8090
167.71.10.37:8080
138.59.177.106:443
218.44.21.114:80
46.105.131.87:80
87.230.19.21:8080
37.157.194.134:443
83.136.245.190:8080
178.210.51.222:8080
108.179.206.219:8080
93.147.141.5:80
178.209.71.63:8080
64.147.15.138:80
12.176.19.218:80
128.65.154.183:443
108.191.2.72:80
217.160.182.191:8080
37.59.24.177:8080
78.24.219.147:8080
212.64.171.206:80
87.106.136.232:8080
211.63.71.72:8080
81.0.63.86:8080
80.21.182.46:80
210.6.85.121:80
188.152.7.140:80
206.189.112.148:8080
70.175.171.251:80
190.147.215.53:22
212.129.24.79:8080
98.24.231.64:80
189.209.217.49:80
91.73.197.90:80
116.48.142.21:443
209.97.168.52:8080
181.57.193.14:80
73.176.241.255:80
173.12.14.133:8080
139.130.241.252:443
200.7.243.108:443
85.152.174.56:80
165.228.24.197:80
159.65.25.128:8080
176.106.183.253:8080
5.88.182.250:80
59.148.227.190:80
31.172.240.91:8080
58.171.42.66:8080
91.205.215.66:443
1.33.230.137:80
82.155.161.203:80
95.128.43.213:8080
47.6.15.79:443
201.184.105.242:443
86.98.156.239:443
190.220.19.82:443
66.34.201.20:7080
87.106.139.101:8080
50.116.86.205:8080
5.154.58.24:80
201.251.133.92:443
101.187.247.29:80
206.81.10.215:8080
60.40.74.197:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	hantnon.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	hantnon.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	hantnon.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	hantnon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	hantnon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	hantnon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	hantnon.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2356	hantnon.exe
2356	hantnon.exe
2356	hantnon.exe
2356	hantnon.exe
2356	hantnon.exe
2356	hantnon.exe
2356	hantnon.exe
2356	hantnon.exe
2356	hantnon.exe
2356	hantnon.exe
2356	hantnon.exe
2356	hantnon.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
920	b0cdec47e68ed0ed86889da8292ee1e7_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
596	b0cdec47e68ed0ed86889da8292ee1e7_JaffaCakes118.exe
920	b0cdec47e68ed0ed86889da8292ee1e7_JaffaCakes118.exe
1804	hantnon.exe
2356	hantnon.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 596 wrote to memory of 920	596	b0cdec47e68ed0ed86889da8292ee1e7_JaffaCakes118.exe	83
PID 596 wrote to memory of 920	596	b0cdec47e68ed0ed86889da8292ee1e7_JaffaCakes118.exe	83
PID 596 wrote to memory of 920	596	b0cdec47e68ed0ed86889da8292ee1e7_JaffaCakes118.exe	83
PID 1804 wrote to memory of 2356	1804	hantnon.exe	90
PID 1804 wrote to memory of 2356	1804	hantnon.exe	90
PID 1804 wrote to memory of 2356	1804	hantnon.exe	90

C:\Users\Admin\AppData\Local\Temp\b0cdec47e68ed0ed86889da8292ee1e7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b0cdec47e68ed0ed86889da8292ee1e7_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:596
- C:\Users\Admin\AppData\Local\Temp\b0cdec47e68ed0ed86889da8292ee1e7_JaffaCakes118.exe
  --67a723fd
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  PID:920

C:\Windows\SysWOW64\hantnon.exe
"C:\Windows\SysWOW64\hantnon.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SysWOW64\hantnon.exe
  --68078c24
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/596-0-0x00000000022A0000-0x00000000022B7000-memory.dmp

Download

memory/596-5-0x00000000021E0000-0x00000000021F1000-memory.dmp

Download

memory/920-6-0x0000000002150000-0x0000000002167000-memory.dmp

Download

memory/920-16-0x0000000000400000-0x0000000000461000-memory.dmp

Download

memory/1804-11-0x0000000000E00000-0x0000000000E17000-memory.dmp

Download

memory/2356-17-0x0000000000E30000-0x0000000000E47000-memory.dmp

Download