Overview

overview

10

Static

static

3

d0435b90e2...18.exe

windows7-x64

10

d0435b90e2...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d0435b90e2265dada4790acbe4bebaa6_JaffaCakes118

  • Size

    448KB

  • Sample

    240906-xseztatcqh

  • MD5

    d0435b90e2265dada4790acbe4bebaa6

  • SHA1

    55ec966fef5d35a5baa35cb774dbde8a3cce7d1e

  • SHA256

    489be0c0e56081c39087832f0a7525c5673ab46464ea22cd7a9045f6cdd320b6

  • SHA512

    cbc5f4032118c556f1422a1b23400101de5617e5dc48d1e888615c8d9363094496212438e6a8b1bdbc4a2a56e8e07bcbeebdfe71ecbaa8a517d125437b58c45e

  • SSDEEP

    12288:xfzaBuiszJbE9mO4sl9kVlAOyQkNvOzxo0:xbMmO4sl9sR2Ot/

Score
10/10
emotetepoch1bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

174.100.27.229:80

209.126.6.222:8080

5.153.250.14:8080

192.241.146.84:8080

95.9.180.128:80

77.55.211.77:8080

85.105.140.135:443

45.33.77.42:8080

77.90.136.129:8080

94.176.234.118:443

190.163.31.26:80

190.6.193.152:8080

190.181.235.46:80

81.198.69.61:80

188.2.217.94:80

114.109.179.60:80

83.169.21.32:7080

137.74.106.111:7080

212.231.60.98:80

170.81.48.2:80
rsa_pubkey.plain

Targets

    • Target

      d0435b90e2265dada4790acbe4bebaa6_JaffaCakes118

    • Size

      448KB

    • MD5

      d0435b90e2265dada4790acbe4bebaa6

    • SHA1

      55ec966fef5d35a5baa35cb774dbde8a3cce7d1e

    • SHA256

      489be0c0e56081c39087832f0a7525c5673ab46464ea22cd7a9045f6cdd320b6

    • SHA512

      cbc5f4032118c556f1422a1b23400101de5617e5dc48d1e888615c8d9363094496212438e6a8b1bdbc4a2a56e8e07bcbeebdfe71ecbaa8a517d125437b58c45e

    • SSDEEP

      12288:xfzaBuiszJbE9mO4sl9kVlAOyQkNvOzxo0:xbMmO4sl9sR2Ot/

    Score
    10/10
    emotetepoch1bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet payload

      Detects Emotet payload in memory.

      trojanbanker

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks