emotet | 9abc9d944c05490bb11efd1b190b41411db0c65cad14a210c1c59533cd6784e4

Analysis

max time kernel
130s
max time network
144s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 01:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7a6c086f7e33519b09f6a7857e203ad_JaffaCakes118.exe
Size

667KB
MD5

a7a6c086f7e33519b09f6a7857e203ad
SHA1

2c71ce41526d4231108eafd7b303f3ac8c6a01fa
SHA256

9abc9d944c05490bb11efd1b190b41411db0c65cad14a210c1c59533cd6784e4
SHA512

d7776f4e42a51a7eed842f4fc87282c5191a32d04c6fbc1d080bfeb6b328c35f4b0c95200874609660b166e24ea5d6958fab8a5e82b440d9d2f236569e2d1477
SSDEEP

12288:6+JJG//twCZ1CFy6jpcFnRO6QuiCDuBMoCrazA:6+J6/twC1N6jiVk6Quix4f

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

104.193.103.61:80

104.131.123.136:443

5.196.108.189:8080

121.124.124.40:7080

87.106.139.101:8080

213.196.135.145:80

50.35.17.13:80

38.18.235.242:80

24.43.32.186:80

82.80.155.43:80

103.86.49.11:8080

113.61.66.94:80

24.137.76.62:80

187.49.206.134:80

42.200.107.142:80

24.179.13.119:80

93.147.212.206:80

108.46.29.236:80

105.186.233.33:80

37.139.21.175:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet payload 5 IoCs

Detects Emotet payload in memory.

trojan banker

Processes:

resource	yara_rule
behavioral1/memory/2392-4-0x0000000000280000-0x0000000000290000-memory.dmp	emotet
behavioral1/memory/2392-7-0x0000000000230000-0x000000000023F000-memory.dmp	emotet
behavioral1/memory/2392-0-0x0000000000260000-0x0000000000272000-memory.dmp	emotet
behavioral1/memory/2664-14-0x0000000000270000-0x0000000000280000-memory.dmp	emotet
behavioral1/memory/2664-10-0x0000000000250000-0x0000000000262000-memory.dmp	emotet

Executes dropped EXE 1 IoCs

Processes:

ir50_qc.exe

pid process

2664 ir50_qc.exe
Drops file in System32 directory 1 IoCs

Processes:

a7a6c086f7e33519b09f6a7857e203ad_JaffaCakes118.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\KBDTURME\ir50_qc.exe a7a6c086f7e33519b09f6a7857e203ad_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

ir50_qc.exe

pid process

2664 ir50_qc.exe
2664 ir50_qc.exe
2664 ir50_qc.exe
2664 ir50_qc.exe
2664 ir50_qc.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

a7a6c086f7e33519b09f6a7857e203ad_JaffaCakes118.exe

pid process

2392 a7a6c086f7e33519b09f6a7857e203ad_JaffaCakes118.exe

pid	process
2664	ir50_qc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\KBDTURME\ir50_qc.exe	a7a6c086f7e33519b09f6a7857e203ad_JaffaCakes118.exe

pid	process
2664	ir50_qc.exe
2664	ir50_qc.exe
2664	ir50_qc.exe
2664	ir50_qc.exe
2664	ir50_qc.exe

pid	process
2392	a7a6c086f7e33519b09f6a7857e203ad_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a7a6c086f7e33519b09f6a7857e203ad_JaffaCakes118.exe

description	pid	process	target process
PID 2392 wrote to memory of 2664	2392	a7a6c086f7e33519b09f6a7857e203ad_JaffaCakes118.exe	ir50_qc.exe
PID 2392 wrote to memory of 2664	2392	a7a6c086f7e33519b09f6a7857e203ad_JaffaCakes118.exe	ir50_qc.exe
PID 2392 wrote to memory of 2664	2392	a7a6c086f7e33519b09f6a7857e203ad_JaffaCakes118.exe	ir50_qc.exe
PID 2392 wrote to memory of 2664	2392	a7a6c086f7e33519b09f6a7857e203ad_JaffaCakes118.exe	ir50_qc.exe

C:\Users\Admin\AppData\Local\Temp\a7a6c086f7e33519b09f6a7857e203ad_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a7a6c086f7e33519b09f6a7857e203ad_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2392

C:\Windows\SysWOW64\KBDTURME\ir50_qc.exe
"C:\Windows\SysWOW64\KBDTURME\ir50_qc.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2664

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\KBDTURME\ir50_qc.exe
Filesize
667KB

MD5
a7a6c086f7e33519b09f6a7857e203ad

SHA1
2c71ce41526d4231108eafd7b303f3ac8c6a01fa

SHA256
9abc9d944c05490bb11efd1b190b41411db0c65cad14a210c1c59533cd6784e4

SHA512
d7776f4e42a51a7eed842f4fc87282c5191a32d04c6fbc1d080bfeb6b328c35f4b0c95200874609660b166e24ea5d6958fab8a5e82b440d9d2f236569e2d1477

Download Submit
memory/2392-4-0x0000000000280000-0x0000000000290000-memory.dmp

Filesize
64KB

Download
memory/2392-7-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/2392-0-0x0000000000260000-0x0000000000272000-memory.dmp

Filesize
72KB

Download
memory/2392-9-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/2664-14-0x0000000000270000-0x0000000000280000-memory.dmp

Filesize
64KB

Download
memory/2664-10-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download