emotet | 2ed2376225d35dda2074bf2358221a30530f3fc15b94d0ce0ab206352e48124f

General

Target

d6989d4d113e3e68e63698f929e567d1_JaffaCakes118.exe
Size

425KB
MD5

d6989d4d113e3e68e63698f929e567d1
SHA1

b19292137d446fa05cd4445af1adc7c06fadfc75
SHA256

2ed2376225d35dda2074bf2358221a30530f3fc15b94d0ce0ab206352e48124f
SHA512

4b323e62f552b39bf67cfefe60f4794fe7384d02c202bad4d0d670eb1b7e9d82bfd403955b07257a3a0567fcb5e2df4d8695c24fef5f28b2788764fd3b7a5788
SSDEEP

6144:U+1SOT3qLavbVUGXjDsDaKaIwLnhc/WGLeGFL7b11UOOKmgyyyyyyyyyyyyyyyyz:jCGXqzacuGfFXUOjmIDi+9R9

Score

10^/10

emotet epoch2 banker discovery trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

167.99.105.223:7080

176.31.200.130:8080

212.129.24.79:8080

37.187.2.199:443

198.199.114.69:8080

91.205.215.66:8080

190.145.67.134:8090

104.131.11.150:8080

67.225.229.55:8080

167.71.10.37:8080

138.201.140.110:8080

185.187.198.15:80

87.230.19.21:8080

185.94.252.13:443

190.53.135.159:21

87.106.139.101:8080

173.249.47.77:8080

169.239.182.217:8080

133.167.80.63:7080

92.222.216.44:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 4 IoCs

pid	Process
2724	d6989d4d113e3e68e63698f929e567d1_JaffaCakes118.exe
2828	d6989d4d113e3e68e63698f929e567d1_JaffaCakes118.exe
2628	pdeftssp.exe
2624	pdeftssp.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	pdeftssp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d6989d4d113e3e68e63698f929e567d1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d6989d4d113e3e68e63698f929e567d1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pdeftssp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pdeftssp.exe

Modifies data under HKEY_USERS 21 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00e8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	pdeftssp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2E158AA9-D91B-4CD6-9360-5C6AC2BA95D3}\WpadDecisionReason = "1"	pdeftssp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-1d-b3-23-ae-c8	pdeftssp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2E158AA9-D91B-4CD6-9360-5C6AC2BA95D3}\02-1d-b3-23-ae-c8	pdeftssp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-1d-b3-23-ae-c8\WpadDecisionReason = "1"	pdeftssp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	pdeftssp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	pdeftssp.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	pdeftssp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2E158AA9-D91B-4CD6-9360-5C6AC2BA95D3}\WpadDecision = "0"	pdeftssp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2E158AA9-D91B-4CD6-9360-5C6AC2BA95D3}\WpadNetworkName = "Network 3"	pdeftssp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	pdeftssp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	pdeftssp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	pdeftssp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	pdeftssp.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2E158AA9-D91B-4CD6-9360-5C6AC2BA95D3}\WpadDecisionTime = a07b31c5cc02db01	pdeftssp.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	pdeftssp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	pdeftssp.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-1d-b3-23-ae-c8\WpadDecisionTime = a07b31c5cc02db01	pdeftssp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-1d-b3-23-ae-c8\WpadDecision = "0"	pdeftssp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	pdeftssp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2E158AA9-D91B-4CD6-9360-5C6AC2BA95D3}	pdeftssp.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2624	pdeftssp.exe
2624	pdeftssp.exe
2624	pdeftssp.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2828	d6989d4d113e3e68e63698f929e567d1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2828	2724	d6989d4d113e3e68e63698f929e567d1_JaffaCakes118.exe	30
PID 2724 wrote to memory of 2828	2724	d6989d4d113e3e68e63698f929e567d1_JaffaCakes118.exe	30
PID 2724 wrote to memory of 2828	2724	d6989d4d113e3e68e63698f929e567d1_JaffaCakes118.exe	30
PID 2724 wrote to memory of 2828	2724	d6989d4d113e3e68e63698f929e567d1_JaffaCakes118.exe	30
PID 2628 wrote to memory of 2624	2628	pdeftssp.exe	32
PID 2628 wrote to memory of 2624	2628	pdeftssp.exe	32
PID 2628 wrote to memory of 2624	2628	pdeftssp.exe	32
PID 2628 wrote to memory of 2624	2628	pdeftssp.exe	32

C:\Users\Admin\AppData\Local\Temp\d6989d4d113e3e68e63698f929e567d1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d6989d4d113e3e68e63698f929e567d1_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Users\Admin\AppData\Local\Temp\d6989d4d113e3e68e63698f929e567d1_JaffaCakes118.exe
  --5dbe2d29
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  PID:2828

C:\Windows\SysWOW64\pdeftssp.exe
"C:\Windows\SysWOW64\pdeftssp.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\pdeftssp.exe
  --fd69183
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\dxcsdyjgbn.dfxcsd

Filesize
252KB

MD5
3778d3bb812b7c07e1bd8065df6db3a0

SHA1
6ec3201b6d5ba4bfbdff06ed191cabcb0024aa4d

SHA256
915996a60e036116f285b23422b3710f1a1a825785298f8333cc48ae09978319

SHA512
323ac82ba37d3d67684f5ac1d0710fc0d5f40d7c3dc7edb64138b9d281b7854c02945f9d89d6c10578d9c36429129b228c58ad913242d8a0936515425068ad06

Download Submit
\ProgramData\dxcsdyjgbn.dfxcsd

Filesize
252KB

MD5
9e21570666258f6b74946fac6169904e

SHA1
39fa98901d61a2e33f0beca6b920a0e55b27de59

SHA256
68bd13f253b16db9659d57ae34dc8615d20241a983b7eedab2f0384f7ee6b51d

SHA512
d91b7c004b91853a2cffe3f2f03ed7405178348c4dd02bcd5256e77dfad13425538e71c1b8d93f1730306527c190e31774974897dc779475bfa2b3f788b94069

Download Submit
memory/2624-37-0x0000000000540000-0x0000000000557000-memory.dmp

Filesize
92KB

Download
memory/2624-42-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2628-25-0x00000000003D0000-0x00000000003E7000-memory.dmp

Filesize
92KB

Download
memory/2628-30-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2724-5-0x0000000000620000-0x0000000000637000-memory.dmp

Filesize
92KB

Download
memory/2724-11-0x0000000000600000-0x0000000000611000-memory.dmp

Filesize
68KB

Download
memory/2724-10-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2828-18-0x00000000003B0000-0x00000000003C7000-memory.dmp

Filesize
92KB

Download
memory/2828-31-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download

Analysis

Sharing