emotet | 49c7a0dc3be0defefcc2b1a0ca5b30a3365434cd018973c076af69e953f41d9c

General

Target

e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe
Size

267KB
MD5

e56bc5b4d75edb4fc828e96295ed7393
SHA1

e80f5d5b4c5ba6c56ae4a984d9c2c7ca83ddef26
SHA256

49c7a0dc3be0defefcc2b1a0ca5b30a3365434cd018973c076af69e953f41d9c
SHA512

2f85af18a060f9540c5430dadb5beb04b3df72f7d9589dc7861a3c23da5ab3f121432e5265e9b70535a007d5b967ff4164a70b97cb7c75adbc187adea3448688
SSDEEP

6144:ed8GfgPu1jnIm2rJ3Rbn7lqCc1dLe0XYg27TyOJWmaTlBcdpPk+UyY:ed8o1jCIXLe0P2ndWzlfD

Score

10^/10

emotet epoch1 banker discovery trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

172.104.233.225:8080

70.32.78.99:8080

213.189.36.51:8080

107.170.27.84:443

181.135.153.203:443

94.183.71.206:7080

87.118.70.69:8080

69.163.33.84:8080

86.42.166.147:80

181.16.17.210:443

111.119.233.65:80

81.169.140.14:443

119.59.124.163:8080

186.15.83.52:8080

163.172.40.218:7080

62.75.143.100:7080

181.91.215.151:990

5.196.35.138:7080

14.160.93.230:80

68.183.190.199:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	runappid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runappid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runappid.exe

Modifies data under HKEY_USERS 25 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	runappid.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-83-4e-24-53-c6	runappid.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-83-4e-24-53-c6\WpadDecisionTime = 50f96b1c6c08db01	runappid.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	runappid.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	runappid.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EC087157-403B-4474-ACBE-27BFAF4FFA25}\WpadNetworkName = "Network 3"	runappid.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	runappid.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	runappid.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EC087157-403B-4474-ACBE-27BFAF4FFA25}	runappid.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EC087157-403B-4474-ACBE-27BFAF4FFA25}\WpadDecision = "0"	runappid.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-83-4e-24-53-c6\WpadDetectedUrl	runappid.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	runappid.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	runappid.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0079000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	runappid.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	runappid.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-83-4e-24-53-c6\WpadDecisionTime = b0c042e26b08db01	runappid.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EC087157-403B-4474-ACBE-27BFAF4FFA25}\WpadDecisionTime = 50f96b1c6c08db01	runappid.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0079000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	runappid.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	runappid.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EC087157-403B-4474-ACBE-27BFAF4FFA25}\WpadDecisionReason = "1"	runappid.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EC087157-403B-4474-ACBE-27BFAF4FFA25}\WpadDecisionTime = b0c042e26b08db01	runappid.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	runappid.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-83-4e-24-53-c6\WpadDecisionReason = "1"	runappid.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EC087157-403B-4474-ACBE-27BFAF4FFA25}\ce-83-4e-24-53-c6	runappid.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-83-4e-24-53-c6\WpadDecision = "0"	runappid.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2268	runappid.exe
2268	runappid.exe
2268	runappid.exe
2268	runappid.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1984	e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 1984	2112	e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe	30
PID 2112 wrote to memory of 1984	2112	e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe	30
PID 2112 wrote to memory of 1984	2112	e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe	30
PID 2112 wrote to memory of 1984	2112	e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe	30
PID 2508 wrote to memory of 2268	2508	runappid.exe	33
PID 2508 wrote to memory of 2268	2508	runappid.exe	33
PID 2508 wrote to memory of 2268	2508	runappid.exe	33
PID 2508 wrote to memory of 2268	2508	runappid.exe	33

C:\Users\Admin\AppData\Local\Temp\e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\e56bc5b4d75edb4fc828e96295ed7393_JaffaCakes118.exe
  --1122cc3b
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  PID:1984

C:\Windows\SysWOW64\runappid.exe
"C:\Windows\SysWOW64\runappid.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\runappid.exe
  --fb27a7c3
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1984-18-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2112-0-0x00000000003E0000-0x00000000003F7000-memory.dmp

Filesize
92KB

Download
memory/2112-6-0x00000000002D0000-0x00000000002E1000-memory.dmp

Filesize
68KB

Download
memory/2112-5-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2268-19-0x00000000005D0000-0x00000000005E7000-memory.dmp

Filesize
92KB

Download
memory/2268-24-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2508-12-0x00000000003D0000-0x00000000003E7000-memory.dmp

Filesize
92KB

Download
memory/2508-17-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing