emotet | cd6be3700babd575f736ba8b5dbcb200a79e68588379a5940a4f34a2826627ea

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac6627ae052f3ae7968cca60e4219905_JaffaCakes118.exe
Size

308KB
MD5

ac6627ae052f3ae7968cca60e4219905
SHA1

5d3a660a5eb9c96e0bc2b6e7c96b21889e95aec5
SHA256

cd6be3700babd575f736ba8b5dbcb200a79e68588379a5940a4f34a2826627ea
SHA512

3e1b3b94d3251cbd66735a35c699a6718ca90178eeed91cd0b0ccd12c4569f075b4dae3d38a42a296fd46a59d1cf642616d3e52068261826cc051b5abc9e71a6
SSDEEP

6144:TqfI2dK4las/gMXzGnZq/TVbY7/qyPoNIZAFJi:TqfIJ4lxgMXyUdskIiW

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

70.121.172.89:80

116.202.234.183:8080

69.30.203.214:8080

185.94.252.104:443

64.183.73.122:80

190.55.181.54:443

37.70.8.161:80

174.137.65.18:80

203.153.216.189:7080

109.116.214.124:443

93.51.50.171:8080

190.160.53.126:80

222.214.218.37:4143

87.106.136.232:8080

113.160.130.116:8443

174.102.48.180:80

79.98.24.39:8080

189.212.199.126:443

89.186.91.200:443

24.233.112.152:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet payload 4 IoCs

Detects Emotet payload in memory.

trojan banker

Processes:

resource	yara_rule
behavioral2/memory/3736-0-0x00000000005D0000-0x00000000005DC000-memory.dmp	emotet
behavioral2/memory/3736-4-0x00000000005C0000-0x00000000005C9000-memory.dmp	emotet
behavioral2/memory/2732-7-0x00000000020C0000-0x00000000020CC000-memory.dmp	emotet
behavioral2/memory/2732-11-0x00000000020C0000-0x00000000020CC000-memory.dmp	emotet

Executes dropped EXE 1 IoCs

Processes:

KBDTT102.exe

pid process

2732 KBDTT102.exe
Drops file in System32 directory 1 IoCs

Processes:

ac6627ae052f3ae7968cca60e4219905_JaffaCakes118.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\nlmproxy\KBDTT102.exe ac6627ae052f3ae7968cca60e4219905_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\nlmproxy\KBDTT102.exe	ac6627ae052f3ae7968cca60e4219905_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

KBDTT102.exe

pid	process
2732	KBDTT102.exe
2732	KBDTT102.exe
2732	KBDTT102.exe
2732	KBDTT102.exe
2732	KBDTT102.exe
2732	KBDTT102.exe
2732	KBDTT102.exe
2732	KBDTT102.exe
2732	KBDTT102.exe
2732	KBDTT102.exe
2732	KBDTT102.exe
2732	KBDTT102.exe
2732	KBDTT102.exe
2732	KBDTT102.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

ac6627ae052f3ae7968cca60e4219905_JaffaCakes118.exe

pid process

3736 ac6627ae052f3ae7968cca60e4219905_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

ac6627ae052f3ae7968cca60e4219905_JaffaCakes118.exeKBDTT102.exe

pid process

3736 ac6627ae052f3ae7968cca60e4219905_JaffaCakes118.exe
3736 ac6627ae052f3ae7968cca60e4219905_JaffaCakes118.exe
2732 KBDTT102.exe
2732 KBDTT102.exe

pid	process
3736	ac6627ae052f3ae7968cca60e4219905_JaffaCakes118.exe

pid	process
3736	ac6627ae052f3ae7968cca60e4219905_JaffaCakes118.exe
3736	ac6627ae052f3ae7968cca60e4219905_JaffaCakes118.exe
2732	KBDTT102.exe
2732	KBDTT102.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ac6627ae052f3ae7968cca60e4219905_JaffaCakes118.exe

description	pid	process	target process
PID 3736 wrote to memory of 2732	3736	ac6627ae052f3ae7968cca60e4219905_JaffaCakes118.exe	KBDTT102.exe
PID 3736 wrote to memory of 2732	3736	ac6627ae052f3ae7968cca60e4219905_JaffaCakes118.exe	KBDTT102.exe
PID 3736 wrote to memory of 2732	3736	ac6627ae052f3ae7968cca60e4219905_JaffaCakes118.exe	KBDTT102.exe

C:\Users\Admin\AppData\Local\Temp\ac6627ae052f3ae7968cca60e4219905_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ac6627ae052f3ae7968cca60e4219905_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3736

C:\Windows\SysWOW64\nlmproxy\KBDTT102.exe
"C:\Windows\SysWOW64\nlmproxy\KBDTT102.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2732

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\nlmproxy\KBDTT102.exe
Filesize
308KB

MD5
ac6627ae052f3ae7968cca60e4219905

SHA1
5d3a660a5eb9c96e0bc2b6e7c96b21889e95aec5

SHA256
cd6be3700babd575f736ba8b5dbcb200a79e68588379a5940a4f34a2826627ea

SHA512
3e1b3b94d3251cbd66735a35c699a6718ca90178eeed91cd0b0ccd12c4569f075b4dae3d38a42a296fd46a59d1cf642616d3e52068261826cc051b5abc9e71a6

Download Submit
memory/2732-7-0x00000000020C0000-0x00000000020CC000-memory.dmp

Filesize
48KB

Download
memory/2732-11-0x00000000020C0000-0x00000000020CC000-memory.dmp

Filesize
48KB

Download
memory/3736-0-0x00000000005D0000-0x00000000005DC000-memory.dmp

Filesize
48KB

Download
memory/3736-4-0x00000000005C0000-0x00000000005C9000-memory.dmp

Filesize
36KB

Download
memory/3736-6-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download