emotet | ed4532a4cfca2d06f30c964adfbcc6fc0215b3720caaa8f08919fff25103aa7d

General

Target
09df7954cd926a36a5736bb215c058d4_JaffaCakes118.exe
Size 660KB
Sample240624-v5fe1athlf
SHA256 ed4532a4cfca2d06f30c964adfbcc6fc0215b3720caaa8f08919fff25103aa7d
MD5 09df7954cd926a36a5736bb215c058d4
SHA1 dd8482a168903ec55e28bcc811bd96c9b466f417
SHA512 7ec192f983b9bfe38099d719b59adc53e5551b358a4e783af7983c2a13067598871599f28872e7c49a54a40bc3b04e409a72ca9103565f9e0cdedbd648506ed4
SSDEEP 6144:z8SpbDpqwF03JFhFB19koLgUKQFEexKBePm2QdjFKH67zM86f5muA2QDQh:xpbDp1avFn9kmfaNgPm25yzM868bfDC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch3 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

203.99.182.135:443
181.97.70.132:8080
115.88.70.226:7080
203.150.19.63:443
216.154.222.52:7080
190.55.86.138:8443
125.99.61.162:7080
83.169.33.157:8080
197.211.244.6:443
80.227.67.18:20
176.58.93.123:80
201.244.125.210:995
186.93.167.147:443
190.96.118.15:443
41.60.202.26:22
139.59.242.76:8080
190.117.206.153:443
152.170.220.95:80
113.52.135.33:7080
181.113.229.139:990
181.230.126.152:8090
45.33.1.161:8080
143.95.101.72:8080
216.70.88.55:8080
110.36.234.146:80
178.249.187.150:7080
186.10.16.244:53
94.177.253.126:80
148.240.52.172:80
181.55.171.237:8080
108.179.216.46:8080
181.53.252.85:990
70.45.30.28:80
201.196.15.79:990
93.78.205.196:443
138.197.140.163:8080
181.231.62.54:80
51.38.134.203:8080
181.57.102.203:8080
94.183.71.206:7080
78.109.34.178:443
186.29.155.101:50000
190.13.146.47:443
200.114.134.8:20
5.189.148.98:8080
46.32.229.152:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	backupsizes.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	backupsizes.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	backupsizes.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	backupsizes.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	backupsizes.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	backupsizes.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	backupsizes.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1724	backupsizes.exe
1724	backupsizes.exe
1724	backupsizes.exe
1724	backupsizes.exe
1724	backupsizes.exe
1724	backupsizes.exe
1724	backupsizes.exe
1724	backupsizes.exe
1724	backupsizes.exe
1724	backupsizes.exe
1724	backupsizes.exe
1724	backupsizes.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4572	09df7954cd926a36a5736bb215c058d4_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
648	09df7954cd926a36a5736bb215c058d4_JaffaCakes118.exe
4572	09df7954cd926a36a5736bb215c058d4_JaffaCakes118.exe
2932	backupsizes.exe
1724	backupsizes.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 4572	648	09df7954cd926a36a5736bb215c058d4_JaffaCakes118.exe	90
PID 648 wrote to memory of 4572	648	09df7954cd926a36a5736bb215c058d4_JaffaCakes118.exe	90
PID 648 wrote to memory of 4572	648	09df7954cd926a36a5736bb215c058d4_JaffaCakes118.exe	90
PID 2932 wrote to memory of 1724	2932	backupsizes.exe	92
PID 2932 wrote to memory of 1724	2932	backupsizes.exe	92
PID 2932 wrote to memory of 1724	2932	backupsizes.exe	92

C:\Users\Admin\AppData\Local\Temp\09df7954cd926a36a5736bb215c058d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09df7954cd926a36a5736bb215c058d4_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:648
- C:\Users\Admin\AppData\Local\Temp\09df7954cd926a36a5736bb215c058d4_JaffaCakes118.exe
  --a7ed8eb0
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  PID:4572

C:\Windows\SysWOW64\backupsizes.exe
"C:\Windows\SysWOW64\backupsizes.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\backupsizes.exe
  --1367cc46
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-4-0x0000000002290000-0x00000000022A0000-memory.dmp

Download

memory/648-1-0x00000000022A0000-0x00000000022B6000-memory.dmp

Download

memory/648-0-0x0000000002280000-0x0000000002281000-memory.dmp

Download

memory/1724-19-0x0000000000E80000-0x0000000000E96000-memory.dmp

Download

memory/2932-12-0x0000000000F90000-0x0000000000FA6000-memory.dmp

Download

memory/4572-7-0x00000000020F0000-0x0000000002106000-memory.dmp

Download

memory/4572-17-0x0000000000400000-0x00000000004A9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads