emotet | ab42a4026c56d0e6895e39edec511411daaf76992c79914c3884d8e5ae0f11c1

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 07:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b24a3483ed359b3501cc44d4dfaa0f2b_JaffaCakes118.exe
Size

632KB
MD5

b24a3483ed359b3501cc44d4dfaa0f2b
SHA1

56bee3305581bb9c4c674b6dd4f9d05d82d44a66
SHA256

ab42a4026c56d0e6895e39edec511411daaf76992c79914c3884d8e5ae0f11c1
SHA512

8f4b33699edc4cfff9cb2c64b4f698301f462ee7014e733d96da878763ca579214f6981120048f0ef736bcad7bf8d015918e3da47ec0946a95f0cf34355fc2c1
SSDEEP

12288:yCjBePRPHFPikH0+IQmOZJ6+Px7ZPp5LfZ9NJ:2PdikU+IQ1Zt7ZTfZjJ

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

68.44.137.144:443

69.30.203.214:8080

67.205.85.243:8080

85.66.181.138:80

74.208.45.104:8080

109.116.214.124:443

95.179.229.244:8080

24.137.76.62:80

95.213.236.64:8080

113.160.130.116:8443

47.146.117.214:80

24.233.112.152:80

87.106.139.101:8080

89.186.91.200:443

91.211.88.52:7080

200.41.121.90:80

107.185.211.16:80

104.131.11.150:443

5.39.91.110:7080

62.138.26.28:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet payload 4 IoCs

Detects Emotet payload in memory.

trojan banker

Processes:

resource	yara_rule
behavioral1/memory/2112-4-0x00000000003D0000-0x00000000003D9000-memory.dmp	emotet
behavioral1/memory/2112-0-0x00000000003E0000-0x00000000003EC000-memory.dmp	emotet
behavioral1/memory/2292-7-0x0000000000320000-0x000000000032C000-memory.dmp	emotet
behavioral1/memory/2292-11-0x0000000000320000-0x000000000032C000-memory.dmp	emotet

Executes dropped EXE 1 IoCs

Processes:

apisetschema.exe

pid process

2292 apisetschema.exe
Drops file in System32 directory 1 IoCs

Processes:

b24a3483ed359b3501cc44d4dfaa0f2b_JaffaCakes118.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\mfc120cht\apisetschema.exe b24a3483ed359b3501cc44d4dfaa0f2b_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

apisetschema.exe

pid process

2292 apisetschema.exe
2292 apisetschema.exe
2292 apisetschema.exe
2292 apisetschema.exe
2292 apisetschema.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

b24a3483ed359b3501cc44d4dfaa0f2b_JaffaCakes118.exe

pid process

2112 b24a3483ed359b3501cc44d4dfaa0f2b_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

b24a3483ed359b3501cc44d4dfaa0f2b_JaffaCakes118.exeapisetschema.exe

pid process

2112 b24a3483ed359b3501cc44d4dfaa0f2b_JaffaCakes118.exe
2112 b24a3483ed359b3501cc44d4dfaa0f2b_JaffaCakes118.exe
2292 apisetschema.exe
2292 apisetschema.exe

pid	process
2292	apisetschema.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\mfc120cht\apisetschema.exe	b24a3483ed359b3501cc44d4dfaa0f2b_JaffaCakes118.exe

pid	process
2292	apisetschema.exe
2292	apisetschema.exe
2292	apisetschema.exe
2292	apisetschema.exe
2292	apisetschema.exe

pid	process
2112	b24a3483ed359b3501cc44d4dfaa0f2b_JaffaCakes118.exe

pid	process
2112	b24a3483ed359b3501cc44d4dfaa0f2b_JaffaCakes118.exe
2112	b24a3483ed359b3501cc44d4dfaa0f2b_JaffaCakes118.exe
2292	apisetschema.exe
2292	apisetschema.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b24a3483ed359b3501cc44d4dfaa0f2b_JaffaCakes118.exe

description	pid	process	target process
PID 2112 wrote to memory of 2292	2112	b24a3483ed359b3501cc44d4dfaa0f2b_JaffaCakes118.exe	apisetschema.exe
PID 2112 wrote to memory of 2292	2112	b24a3483ed359b3501cc44d4dfaa0f2b_JaffaCakes118.exe	apisetschema.exe
PID 2112 wrote to memory of 2292	2112	b24a3483ed359b3501cc44d4dfaa0f2b_JaffaCakes118.exe	apisetschema.exe
PID 2112 wrote to memory of 2292	2112	b24a3483ed359b3501cc44d4dfaa0f2b_JaffaCakes118.exe	apisetschema.exe

C:\Users\Admin\AppData\Local\Temp\b24a3483ed359b3501cc44d4dfaa0f2b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b24a3483ed359b3501cc44d4dfaa0f2b_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112

C:\Windows\SysWOW64\mfc120cht\apisetschema.exe
"C:\Windows\SysWOW64\mfc120cht\apisetschema.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2292

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mfc120cht\apisetschema.exe
Filesize
632KB

MD5
b24a3483ed359b3501cc44d4dfaa0f2b

SHA1
56bee3305581bb9c4c674b6dd4f9d05d82d44a66

SHA256
ab42a4026c56d0e6895e39edec511411daaf76992c79914c3884d8e5ae0f11c1

SHA512
8f4b33699edc4cfff9cb2c64b4f698301f462ee7014e733d96da878763ca579214f6981120048f0ef736bcad7bf8d015918e3da47ec0946a95f0cf34355fc2c1

Download Submit
memory/2112-4-0x00000000003D0000-0x00000000003D9000-memory.dmp

Filesize
36KB

Download
memory/2112-0-0x00000000003E0000-0x00000000003EC000-memory.dmp

Filesize
48KB

Download
memory/2112-6-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2292-7-0x0000000000320000-0x000000000032C000-memory.dmp

Filesize
48KB

Download
memory/2292-11-0x0000000000320000-0x000000000032C000-memory.dmp

Filesize
48KB

Download