emotet | bcd6583897a4d287ec10867aa2a1f5e92d410390c69b0a1b218fd571e72b37e1

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2c653d5a1f4c30a1eb9b41f6bb1c765_JaffaCakes118.exe
Size

624KB
MD5

d2c653d5a1f4c30a1eb9b41f6bb1c765
SHA1

f3659d3cac57810eddd83b6bfd8daac3d18fae0c
SHA256

bcd6583897a4d287ec10867aa2a1f5e92d410390c69b0a1b218fd571e72b37e1
SHA512

c611be04bfb70f9a94e9064d313405a9903b2026278e2ce89016bb0c300a40f1fe77e22341c497c8d27a138eed267013d7b0838e180d3a0e67d12893e2418c41
SSDEEP

12288:lIGeyldceHHy5TXTkiHyKl9tuHiRzD8XkQyg:lIGeylC7jtHFpdDPg

Score

10^/10

emotet epoch3 banker discovery trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

220.147.247.145:80

45.79.16.230:7080

145.239.169.32:7080

190.85.46.52:7080

185.142.236.163:443

200.120.241.238:80

37.205.9.252:7080

202.166.170.43:80

203.153.216.178:7080

37.187.100.220:7080

60.125.114.64:443

115.78.11.155:80

88.247.58.26:80

189.150.209.206:80

103.229.73.17:8080

157.245.138.101:7080

181.122.154.240:80

113.160.248.110:80

46.32.229.152:8080

103.48.68.173:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet payload 5 IoCs

Detects Emotet payload in memory.

trojan banker

resource	yara_rule
behavioral1/memory/1016-0-0x00000000001F0000-0x0000000000202000-memory.dmp	emotet
behavioral1/memory/1016-4-0x00000000002A0000-0x00000000002B0000-memory.dmp	emotet
behavioral1/memory/1016-7-0x00000000001E0000-0x00000000001EF000-memory.dmp	emotet
behavioral1/memory/1828-10-0x0000000000380000-0x0000000000392000-memory.dmp	emotet
behavioral1/memory/1828-14-0x00000000002E0000-0x00000000002F0000-memory.dmp	emotet

Executes dropped EXE 1 IoCs

pid	Process
1828	audiodev.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\midimap\audiodev.exe	d2c653d5a1f4c30a1eb9b41f6bb1c765_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	audiodev.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2c653d5a1f4c30a1eb9b41f6bb1c765_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1828	audiodev.exe
1828	audiodev.exe
1828	audiodev.exe
1828	audiodev.exe
1828	audiodev.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1016	d2c653d5a1f4c30a1eb9b41f6bb1c765_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1016	d2c653d5a1f4c30a1eb9b41f6bb1c765_JaffaCakes118.exe
1828	audiodev.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 1828	1016	d2c653d5a1f4c30a1eb9b41f6bb1c765_JaffaCakes118.exe	30
PID 1016 wrote to memory of 1828	1016	d2c653d5a1f4c30a1eb9b41f6bb1c765_JaffaCakes118.exe	30
PID 1016 wrote to memory of 1828	1016	d2c653d5a1f4c30a1eb9b41f6bb1c765_JaffaCakes118.exe	30
PID 1016 wrote to memory of 1828	1016	d2c653d5a1f4c30a1eb9b41f6bb1c765_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\d2c653d5a1f4c30a1eb9b41f6bb1c765_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d2c653d5a1f4c30a1eb9b41f6bb1c765_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\SysWOW64\midimap\audiodev.exe
  "C:\Windows\SysWOW64\midimap\audiodev.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\midimap\audiodev.exe

Filesize
624KB

MD5
d2c653d5a1f4c30a1eb9b41f6bb1c765

SHA1
f3659d3cac57810eddd83b6bfd8daac3d18fae0c

SHA256
bcd6583897a4d287ec10867aa2a1f5e92d410390c69b0a1b218fd571e72b37e1

SHA512
c611be04bfb70f9a94e9064d313405a9903b2026278e2ce89016bb0c300a40f1fe77e22341c497c8d27a138eed267013d7b0838e180d3a0e67d12893e2418c41

Download Submit
memory/1016-0-0x00000000001F0000-0x0000000000202000-memory.dmp

Filesize
72KB

Download
memory/1016-4-0x00000000002A0000-0x00000000002B0000-memory.dmp

Filesize
64KB

Download
memory/1016-7-0x00000000001E0000-0x00000000001EF000-memory.dmp

Filesize
60KB

Download
memory/1016-9-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1828-10-0x0000000000380000-0x0000000000392000-memory.dmp

Filesize
72KB

Download
memory/1828-14-0x00000000002E0000-0x00000000002F0000-memory.dmp

Filesize
64KB

Download