emotet | 9cdfee7919d8c8f6c5a6ec22dbeb7761b46530f1f0d6ae7f78c740b8ed45d927

General

Target

d1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118.exe
Size

603KB
MD5

d1ba3b3cb0e999eebe293e1b4f41e9aa
SHA1

210a5c8d6421b8f924c94ea25fb890f0bae6d90e
SHA256

9cdfee7919d8c8f6c5a6ec22dbeb7761b46530f1f0d6ae7f78c740b8ed45d927
SHA512

7b522289022a7dc8299465fc123ac2542db7ddd17e95ab9f771982f6d9ca9519178b5e2c12ff031e103d910872d3eb47e7666e175285d26a10a52921140d2805
SSDEEP

12288:BkfdhQmseiH0lXPftSfWOOOR9tQdj363A+S:BEqcftSLVQdj363A+S

Score

10^/10

emotet epoch2 banker discovery trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

2.38.99.79:80

98.24.231.64:80

47.156.70.145:80

37.59.24.177:8080

66.34.201.20:7080

108.179.206.219:8080

45.56.88.91:443

206.189.112.148:8080

120.150.246.241:80

190.56.255.118:80

200.71.148.138:8080

192.241.255.77:8080

211.63.71.72:8080

190.53.135.159:21

183.102.238.69:465

108.191.2.72:80

107.170.24.125:8080

167.114.242.226:8080

91.73.197.90:80

178.209.71.63:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

iascompon.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	iascompon.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	iascompon.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	iascompon.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	iascompon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

iascompon.exed1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118.exed1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118.exeiascompon.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iascompon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iascompon.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

iascompon.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	iascompon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	iascompon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	iascompon.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

iascompon.exe

pid process

3164 iascompon.exe
3164 iascompon.exe
3164 iascompon.exe
3164 iascompon.exe
3164 iascompon.exe
3164 iascompon.exe
3164 iascompon.exe
3164 iascompon.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

d1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118.exe

pid process

4716 d1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118.exe

pid	process
3164	iascompon.exe
3164	iascompon.exe
3164	iascompon.exe
3164	iascompon.exe
3164	iascompon.exe
3164	iascompon.exe
3164	iascompon.exe
3164	iascompon.exe

pid	process
4716	d1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

d1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118.exed1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118.exeiascompon.exeiascompon.exe

pid	process
2856	d1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118.exe
2856	d1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118.exe
4716	d1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118.exe
4716	d1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118.exe
4084	iascompon.exe
4084	iascompon.exe
3164	iascompon.exe
3164	iascompon.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

d1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118.exeiascompon.exe

description	pid	process	target process
PID 2856 wrote to memory of 4716	2856	d1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118.exe	d1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118.exe
PID 2856 wrote to memory of 4716	2856	d1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118.exe	d1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118.exe
PID 2856 wrote to memory of 4716	2856	d1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118.exe	d1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118.exe
PID 4084 wrote to memory of 3164	4084	iascompon.exe	iascompon.exe
PID 4084 wrote to memory of 3164	4084	iascompon.exe	iascompon.exe
PID 4084 wrote to memory of 3164	4084	iascompon.exe	iascompon.exe

C:\Users\Admin\AppData\Local\Temp\d1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856

C:\Users\Admin\AppData\Local\Temp\d1ba3b3cb0e999eebe293e1b4f41e9aa_JaffaCakes118.exe
--aa618b89
2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:4716

C:\Windows\SysWOW64\iascompon.exe
"C:\Windows\SysWOW64\iascompon.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4084

C:\Windows\SysWOW64\iascompon.exe
--a8dcfabf
2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3164

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2856-2-0x00000000022E0000-0x00000000022F1000-memory.dmp

Filesize
68KB

Download
memory/2856-0-0x0000000002410000-0x0000000002427000-memory.dmp

Filesize
92KB

Download
memory/3164-18-0x0000000000630000-0x0000000000647000-memory.dmp

Filesize
92KB

Download
memory/4084-12-0x0000000000E50000-0x0000000000E67000-memory.dmp

Filesize
92KB

Download
memory/4716-6-0x00000000022A0000-0x00000000022B7000-memory.dmp

Filesize
92KB

Download
memory/4716-11-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4716-17-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads