emotet | 33a6d7f3da505bb94079a0f8837e4de0083cf5cd782f665faf0589c290cac930

General

Target

57531b347491ca0eb1c28d644590acfa_JaffaCakes118.exe
Size

323KB
MD5

57531b347491ca0eb1c28d644590acfa
SHA1

d093e2e7f5a048b5c58abb212b394f294979fb4d
SHA256

33a6d7f3da505bb94079a0f8837e4de0083cf5cd782f665faf0589c290cac930
SHA512

4b9c2f5f6ddea17b1c6e1686a3a54279e11bb37eecab561646d919bccd00ebd17bb43d7165a24b6fde645c76242d6c23f0f462c0e7a60d0abe468c9a9f834db3
SSDEEP

6144:AvGO3yl828vcPv2yv8vrvvvLvvvLvvvrvvvLvvvrvjvrvTPnbH7fvTv1KkOOU0qy:Q1y6Kl05

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

172.105.11.15:8080

91.121.116.137:443

80.79.23.144:443

138.201.140.110:8080

95.128.43.213:8080

190.228.72.244:53

185.94.252.13:443

37.157.194.134:443

45.79.188.67:8080

27.4.80.183:443

80.11.163.139:443

152.89.236.214:8080

62.75.187.192:8080

189.209.217.49:80

190.106.97.230:443

222.214.218.192:8080

63.142.253.122:8080

206.189.98.125:8080

181.31.213.158:8080

78.24.219.147:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	conchore.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 25 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	conchore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	conchore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{717DBA70-2010-4850-9344-1A4EAC3901F8}\WpadDecisionTime = 305568a60bd9da01	conchore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	conchore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{717DBA70-2010-4850-9344-1A4EAC3901F8}\WpadDecision = "0"	conchore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-15-98-67-43-1b\WpadDecisionReason = "1"	conchore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-15-98-67-43-1b\WpadDecisionTime = 702a4fc80bd9da01	conchore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	conchore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	conchore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	conchore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{717DBA70-2010-4850-9344-1A4EAC3901F8}	conchore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{717DBA70-2010-4850-9344-1A4EAC3901F8}\WpadDecisionReason = "1"	conchore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{717DBA70-2010-4850-9344-1A4EAC3901F8}\WpadNetworkName = "Network 3"	conchore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{717DBA70-2010-4850-9344-1A4EAC3901F8}\WpadDecisionTime = 702a4fc80bd9da01	conchore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	conchore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	conchore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-15-98-67-43-1b\WpadDecisionTime = 305568a60bd9da01	conchore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-15-98-67-43-1b\WpadDetectedUrl	conchore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	conchore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	conchore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00af000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	conchore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00af000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	conchore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-15-98-67-43-1b	conchore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{717DBA70-2010-4850-9344-1A4EAC3901F8}\92-15-98-67-43-1b	conchore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-15-98-67-43-1b\WpadDecision = "0"	conchore.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2744	conchore.exe
2744	conchore.exe
2744	conchore.exe
2744	conchore.exe
2744	conchore.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2756	57531b347491ca0eb1c28d644590acfa_JaffaCakes118.exe

Suspicious use of UnmapMainImage 4 IoCs

pid	Process
2988	57531b347491ca0eb1c28d644590acfa_JaffaCakes118.exe
2756	57531b347491ca0eb1c28d644590acfa_JaffaCakes118.exe
2628	conchore.exe
2744	conchore.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2756	2988	57531b347491ca0eb1c28d644590acfa_JaffaCakes118.exe	30
PID 2988 wrote to memory of 2756	2988	57531b347491ca0eb1c28d644590acfa_JaffaCakes118.exe	30
PID 2988 wrote to memory of 2756	2988	57531b347491ca0eb1c28d644590acfa_JaffaCakes118.exe	30
PID 2988 wrote to memory of 2756	2988	57531b347491ca0eb1c28d644590acfa_JaffaCakes118.exe	30
PID 2628 wrote to memory of 2744	2628	conchore.exe	32
PID 2628 wrote to memory of 2744	2628	conchore.exe	32
PID 2628 wrote to memory of 2744	2628	conchore.exe	32
PID 2628 wrote to memory of 2744	2628	conchore.exe	32

C:\Users\Admin\AppData\Local\Temp\57531b347491ca0eb1c28d644590acfa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\57531b347491ca0eb1c28d644590acfa_JaffaCakes118.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Admin\AppData\Local\Temp\57531b347491ca0eb1c28d644590acfa_JaffaCakes118.exe
  --c385b723
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of UnmapMainImage
  PID:2756

C:\Windows\SysWOW64\conchore.exe
"C:\Windows\SysWOW64\conchore.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\conchore.exe
  --91ec074d
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2628-5-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2744-9-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2744-10-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2744-11-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2744-12-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2756-4-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2756-8-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2988-0-0x00000000003D0000-0x00000000003E5000-memory.dmp

Filesize
84KB

Download
memory/2988-3-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2988-2-0x00000000003D0000-0x00000000003E5000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing