emotet | 3a9e0b3f377affb747730138ce63f022b23d9b4e2aae440fcb7d3a3edbc9b91e

General

Target

d3d0f588479ec9aede0f5831c1770adc_JaffaCakes118.dll
Size

340KB
MD5

d3d0f588479ec9aede0f5831c1770adc
SHA1

b519f97830c7edeedeef64b2a11f0580c8776cfb
SHA256

3a9e0b3f377affb747730138ce63f022b23d9b4e2aae440fcb7d3a3edbc9b91e
SHA512

d47e81d5c945f38999b5fa4af89016181f595d600f5431c4cb40ad3b4164a056c870e70fa718991d32169c2152b17069bf9e6114377f145f1637bdceed9d31b6
SSDEEP

3072:vvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXHWP:v206xWgGxLxWN40PDKR/JnX2P

Score

10^/10

emotet epoch2 banker discovery trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

69.38.130.14:80

195.159.28.230:8080

162.241.204.233:8080

115.21.224.117:80

78.189.148.42:80

181.165.68.127:80

78.188.225.105:80

161.0.153.60:80

89.106.251.163:80

172.125.40.123:80

5.39.91.110:7080

110.145.11.73:80

190.251.200.206:80

144.217.7.207:7080

75.109.111.18:80

75.177.207.146:80

139.59.60.244:8080

70.183.211.3:80

95.213.236.64:8080

61.19.246.238:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Blocklisted process makes network request 6 IoCs

flow	pid	Process
4	1536	rundll32.exe
5	1536	rundll32.exe
8	1536	rundll32.exe
11	1536	rundll32.exe
12	1536	rundll32.exe
13	1536	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Eazhn\jngv.arg	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1536	rundll32.exe
1536	rundll32.exe
1536	rundll32.exe
1536	rundll32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
848	rundll32.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 848	1404	rundll32.exe	31
PID 1404 wrote to memory of 848	1404	rundll32.exe	31
PID 1404 wrote to memory of 848	1404	rundll32.exe	31
PID 1404 wrote to memory of 848	1404	rundll32.exe	31
PID 1404 wrote to memory of 848	1404	rundll32.exe	31
PID 1404 wrote to memory of 848	1404	rundll32.exe	31
PID 1404 wrote to memory of 848	1404	rundll32.exe	31
PID 848 wrote to memory of 2292	848	rundll32.exe	32
PID 848 wrote to memory of 2292	848	rundll32.exe	32
PID 848 wrote to memory of 2292	848	rundll32.exe	32
PID 848 wrote to memory of 2292	848	rundll32.exe	32
PID 848 wrote to memory of 2292	848	rundll32.exe	32
PID 848 wrote to memory of 2292	848	rundll32.exe	32
PID 848 wrote to memory of 2292	848	rundll32.exe	32
PID 2292 wrote to memory of 1536	2292	rundll32.exe	33
PID 2292 wrote to memory of 1536	2292	rundll32.exe	33
PID 2292 wrote to memory of 1536	2292	rundll32.exe	33
PID 2292 wrote to memory of 1536	2292	rundll32.exe	33
PID 2292 wrote to memory of 1536	2292	rundll32.exe	33
PID 2292 wrote to memory of 1536	2292	rundll32.exe	33
PID 2292 wrote to memory of 1536	2292	rundll32.exe	33

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3d0f588479ec9aede0f5831c1770adc_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3d0f588479ec9aede0f5831c1770adc_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Eazhn\jngv.arg",WjRLQzHusdjINgv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2292
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Eazhn\jngv.arg",#1
      4⤵
      Blocklisted process makes network request
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/848-0-0x00000000001C0000-0x00000000001E0000-memory.dmp

Filesize
128KB

Download
memory/848-1-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/848-2-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/1536-6-0x0000000010000000-0x000000001005B000-memory.dmp

Filesize
364KB

Download
memory/1536-7-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/1536-8-0x0000000010000000-0x000000001005B000-memory.dmp

Filesize
364KB

Download
memory/1536-9-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/2292-4-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/2292-3-0x0000000010000000-0x000000001005B000-memory.dmp

Filesize
364KB

Download
memory/2292-5-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing