emotet | 33a6d7f3da505bb94079a0f8837e4de0083cf5cd782f665faf0589c290cac930

General

Target

57531b347491ca0eb1c28d644590acfa_JaffaCakes118.exe
Size

323KB
MD5

57531b347491ca0eb1c28d644590acfa
SHA1

d093e2e7f5a048b5c58abb212b394f294979fb4d
SHA256

33a6d7f3da505bb94079a0f8837e4de0083cf5cd782f665faf0589c290cac930
SHA512

4b9c2f5f6ddea17b1c6e1686a3a54279e11bb37eecab561646d919bccd00ebd17bb43d7165a24b6fde645c76242d6c23f0f462c0e7a60d0abe468c9a9f834db3
SSDEEP

6144:AvGO3yl828vcPv2yv8vrvvvLvvvLvvvrvvvLvvvrvjvrvTPnbH7fvTv1KkOOU0qy:Q1y6Kl05

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

172.105.11.15:8080

91.121.116.137:443

80.79.23.144:443

138.201.140.110:8080

95.128.43.213:8080

190.228.72.244:53

185.94.252.13:443

37.157.194.134:443

45.79.188.67:8080

27.4.80.183:443

80.11.163.139:443

152.89.236.214:8080

62.75.187.192:8080

189.209.217.49:80

190.106.97.230:443

222.214.218.192:8080

63.142.253.122:8080

206.189.98.125:8080

181.31.213.158:8080

78.24.219.147:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	190.228.72.244

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	loadamove.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	loadamove.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	loadamove.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	loadamove.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	loadamove.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	loadamove.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	loadamove.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2576	loadamove.exe
2576	loadamove.exe
2576	loadamove.exe
2576	loadamove.exe
2576	loadamove.exe
2576	loadamove.exe
2576	loadamove.exe
2576	loadamove.exe
2576	loadamove.exe
2576	loadamove.exe
2576	loadamove.exe
2576	loadamove.exe
2576	loadamove.exe
2576	loadamove.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
748	57531b347491ca0eb1c28d644590acfa_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4756	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4756	AUDIODG.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 748	4556	57531b347491ca0eb1c28d644590acfa_JaffaCakes118.exe	90
PID 4556 wrote to memory of 748	4556	57531b347491ca0eb1c28d644590acfa_JaffaCakes118.exe	90
PID 4556 wrote to memory of 748	4556	57531b347491ca0eb1c28d644590acfa_JaffaCakes118.exe	90
PID 2444 wrote to memory of 2576	2444	loadamove.exe	98
PID 2444 wrote to memory of 2576	2444	loadamove.exe	98
PID 2444 wrote to memory of 2576	2444	loadamove.exe	98

C:\Users\Admin\AppData\Local\Temp\57531b347491ca0eb1c28d644590acfa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\57531b347491ca0eb1c28d644590acfa_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Users\Admin\AppData\Local\Temp\57531b347491ca0eb1c28d644590acfa_JaffaCakes118.exe
  --c385b723
  2⤵
  - Suspicious behavior: RenamesItself
  PID:748

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e8 0x504
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Windows\SysWOW64\loadamove.exe
"C:\Windows\SysWOW64\loadamove.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\loadamove.exe
  --16e3a682
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-5-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/748-6-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/748-12-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2444-7-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2576-13-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2576-14-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2576-16-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2576-17-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4556-0-0x00000000023E0000-0x00000000023F5000-memory.dmp

Filesize
84KB

Download
memory/4556-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4556-4-0x00000000023E0000-0x00000000023F5000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing