emotet | a21ad6f8ad07e322c21ffbfc112929a91212f4418158cc9e5df477c6f62ecd67

General

Target

d2a687f1a5cc5bf722a824ff95491f08_JaffaCakes118.exe
Size

303KB
MD5

d2a687f1a5cc5bf722a824ff95491f08
SHA1

a6b7b35392a94a1f970d11d1f86b71803ebe13cc
SHA256

a21ad6f8ad07e322c21ffbfc112929a91212f4418158cc9e5df477c6f62ecd67
SHA512

01cd1d4db382123f061e2bfda172af9b1404e73445f4e31686dab4a76c152f862f234ab47e2e71396567bbab0a8bb22e568454cf3fa8f6d6518f6ff03080f2a4
SSDEEP

3072:sNzPwNwAtJKqgYLdcF7pGG7MjzQPcxswlVQN2Lxu2ntX8NUX7uFLuloc:sJPwNwAt/T2F7icN8U2tM6iV8

Score

10^/10

emotet epoch3 banker discovery trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

190.191.171.72:80

5.189.168.53:8080

162.241.41.111:7080

190.85.46.52:7080

37.205.9.252:7080

172.96.190.154:8080

120.51.34.254:80

181.95.133.104:80

139.59.61.215:443

157.7.164.178:8081

113.193.239.51:443

67.121.104.51:20

41.185.29.128:8080

86.57.216.23:80

185.80.172.199:80

54.38.143.245:8080

41.212.89.128:80

223.17.215.76:80

37.187.100.220:7080

167.71.227.113:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet payload 5 IoCs

Detects Emotet payload in memory.

trojan banker

Processes:

resource	yara_rule
behavioral1/memory/2108-4-0x0000000000270000-0x0000000000280000-memory.dmp	emotet
behavioral1/memory/2108-7-0x0000000000240000-0x000000000024F000-memory.dmp	emotet
behavioral1/memory/2108-0-0x0000000000250000-0x0000000000262000-memory.dmp	emotet
behavioral1/memory/1392-14-0x0000000000260000-0x0000000000270000-memory.dmp	emotet
behavioral1/memory/1392-10-0x0000000000240000-0x0000000000252000-memory.dmp	emotet

Executes dropped EXE 1 IoCs

Processes:

FM20ENU.exe

pid process

1392 FM20ENU.exe
Drops file in System32 directory 1 IoCs

Processes:

d2a687f1a5cc5bf722a824ff95491f08_JaffaCakes118.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\netprof\FM20ENU.exe d2a687f1a5cc5bf722a824ff95491f08_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1392	FM20ENU.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\netprof\FM20ENU.exe	d2a687f1a5cc5bf722a824ff95491f08_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

d2a687f1a5cc5bf722a824ff95491f08_JaffaCakes118.exeFM20ENU.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2a687f1a5cc5bf722a824ff95491f08_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FM20ENU.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

FM20ENU.exe

pid process

1392 FM20ENU.exe
1392 FM20ENU.exe
1392 FM20ENU.exe
1392 FM20ENU.exe
1392 FM20ENU.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

d2a687f1a5cc5bf722a824ff95491f08_JaffaCakes118.exe

pid process

2108 d2a687f1a5cc5bf722a824ff95491f08_JaffaCakes118.exe

pid	process
1392	FM20ENU.exe
1392	FM20ENU.exe
1392	FM20ENU.exe
1392	FM20ENU.exe
1392	FM20ENU.exe

pid	process
2108	d2a687f1a5cc5bf722a824ff95491f08_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d2a687f1a5cc5bf722a824ff95491f08_JaffaCakes118.exe

description	pid	process	target process
PID 2108 wrote to memory of 1392	2108	d2a687f1a5cc5bf722a824ff95491f08_JaffaCakes118.exe	FM20ENU.exe
PID 2108 wrote to memory of 1392	2108	d2a687f1a5cc5bf722a824ff95491f08_JaffaCakes118.exe	FM20ENU.exe
PID 2108 wrote to memory of 1392	2108	d2a687f1a5cc5bf722a824ff95491f08_JaffaCakes118.exe	FM20ENU.exe
PID 2108 wrote to memory of 1392	2108	d2a687f1a5cc5bf722a824ff95491f08_JaffaCakes118.exe	FM20ENU.exe

C:\Users\Admin\AppData\Local\Temp\d2a687f1a5cc5bf722a824ff95491f08_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d2a687f1a5cc5bf722a824ff95491f08_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2108

C:\Windows\SysWOW64\netprof\FM20ENU.exe
"C:\Windows\SysWOW64\netprof\FM20ENU.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\netprof\FM20ENU.exe

Filesize
303KB

MD5
d2a687f1a5cc5bf722a824ff95491f08

SHA1
a6b7b35392a94a1f970d11d1f86b71803ebe13cc

SHA256
a21ad6f8ad07e322c21ffbfc112929a91212f4418158cc9e5df477c6f62ecd67

SHA512
01cd1d4db382123f061e2bfda172af9b1404e73445f4e31686dab4a76c152f862f234ab47e2e71396567bbab0a8bb22e568454cf3fa8f6d6518f6ff03080f2a4

Download Submit
memory/1392-14-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/1392-10-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/2108-4-0x0000000000270000-0x0000000000280000-memory.dmp

Filesize
64KB

Download
memory/2108-7-0x0000000000240000-0x000000000024F000-memory.dmp

Filesize
60KB

Download
memory/2108-0-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download
memory/2108-9-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads