Overview

overview

10

Static

static

3

d141d0126a...18.exe

windows7-x64

10

d141d0126a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d141d0126a61fa8256aa363f908c12d1_JaffaCakes118

  • Size

    896KB

  • Sample

    240907-gzfxpayeml

  • MD5

    d141d0126a61fa8256aa363f908c12d1

  • SHA1

    5fc0fb3cefac366d260c9e1a6e5e1f1f8e71029f

  • SHA256

    df2403ae9f897bbbf628ae4b082ea99f3deedd50917c0e1af5fc5ac2910524cc

  • SHA512

    f043eb7083f05f8437622098a3b80305c359abf58c0eca1e65aebb405e20fd3b46eb3325579348272d0402f0cdc7885d5274df13c7f76cc46d39d42053f4eec7

  • SSDEEP

    12288:Fxn1BXbDf5Ss1Opjjy+MdMhzp419mu6JWxE6p2wm7:LbFFOpXy+MR19+W260wm7

Score
10/10
emotetepoch2bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

47.146.117.214:80

62.108.54.22:8080

212.51.142.238:8080

190.160.53.126:80

87.106.136.232:8080

74.208.45.104:8080

121.124.124.40:7080

124.45.106.173:443

76.27.179.47:80

210.165.156.91:80

61.19.246.238:443

81.2.235.111:8080

169.239.182.217:8080

181.230.116.163:80

139.130.242.43:80

46.105.131.87:80

139.59.60.244:8080

222.214.218.37:4143

41.60.200.34:80

200.55.243.138:8080
rsa_pubkey.plain

Targets

    • Target

      d141d0126a61fa8256aa363f908c12d1_JaffaCakes118

    • Size

      896KB

    • MD5

      d141d0126a61fa8256aa363f908c12d1

    • SHA1

      5fc0fb3cefac366d260c9e1a6e5e1f1f8e71029f

    • SHA256

      df2403ae9f897bbbf628ae4b082ea99f3deedd50917c0e1af5fc5ac2910524cc

    • SHA512

      f043eb7083f05f8437622098a3b80305c359abf58c0eca1e65aebb405e20fd3b46eb3325579348272d0402f0cdc7885d5274df13c7f76cc46d39d42053f4eec7

    • SSDEEP

      12288:Fxn1BXbDf5Ss1Opjjy+MdMhzp419mu6JWxE6p2wm7:LbFFOpXy+MR19+W260wm7

    Score
    10/10
    emotetepoch2bankerdiscoverytrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Emotet payload

      Detects Emotet payload in memory.

      trojanbanker

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks