emotet | 4c4df0964e806a37f38f63c4eec8c5320639c93d943456c3aed7aec2f1f888d6

Analysis

max time kernel
144s
max time network
151s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 07:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b260c10711b68025524046ac35db73ad_JaffaCakes118.exe
Size

427KB
MD5

b260c10711b68025524046ac35db73ad
SHA1

17596e03dcd534d6f10061c8055d94b3973e108f
SHA256

4c4df0964e806a37f38f63c4eec8c5320639c93d943456c3aed7aec2f1f888d6
SHA512

36b391cadfbc5a99b63ab5c1eb5deb6239c5f0be1c2f12701f3175678b10024ba78080d05edcf1cbd5671fbf4476fb7b3f3765ed84f7146ad81c14fb2a5f4ad3
SSDEEP

6144:vXBr9LW/6DUvum8r71YQvq6H/iaRT8oITZO/rVurq:vXdNDDUvum8r5lv7Ha+ThmZo5uG

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

71.72.196.159:80

134.209.36.254:8080

120.138.30.150:8080

94.23.216.33:80

157.245.99.39:8080

137.59.187.107:8080

94.23.237.171:443

61.19.246.238:443

156.155.166.221:80

50.35.17.13:80

153.137.36.142:80

91.211.88.52:7080

209.141.54.221:8080

185.94.252.104:443

174.45.13.118:80

87.106.136.232:8080

62.75.141.82:80

213.196.135.145:80

188.219.31.12:80

82.80.155.43:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet payload 6 IoCs

Detects Emotet payload in memory.

trojan banker

Processes:

resource	yara_rule
behavioral1/memory/2916-7-0x00000000002F0000-0x00000000002FF000-memory.dmp	emotet
behavioral1/memory/2916-4-0x00000000002D0000-0x00000000002E0000-memory.dmp	emotet
behavioral1/memory/2916-0-0x00000000002B0000-0x00000000002C2000-memory.dmp	emotet
behavioral1/memory/2748-14-0x0000000000250000-0x0000000000260000-memory.dmp	emotet
behavioral1/memory/2748-15-0x0000000000250000-0x0000000000260000-memory.dmp	emotet
behavioral1/memory/2748-10-0x0000000000230000-0x0000000000242000-memory.dmp	emotet

Executes dropped EXE 1 IoCs

Processes:

mobsync.exe

pid process

2748 mobsync.exe
Drops file in System32 directory 1 IoCs

Processes:

b260c10711b68025524046ac35db73ad_JaffaCakes118.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\mfc110jpn\mobsync.exe b260c10711b68025524046ac35db73ad_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

mobsync.exe

pid process

2748 mobsync.exe
2748 mobsync.exe
2748 mobsync.exe
2748 mobsync.exe
2748 mobsync.exe
2748 mobsync.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

b260c10711b68025524046ac35db73ad_JaffaCakes118.exe

pid process

2916 b260c10711b68025524046ac35db73ad_JaffaCakes118.exe

pid	process
2748	mobsync.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\mfc110jpn\mobsync.exe	b260c10711b68025524046ac35db73ad_JaffaCakes118.exe

pid	process
2748	mobsync.exe
2748	mobsync.exe
2748	mobsync.exe
2748	mobsync.exe
2748	mobsync.exe
2748	mobsync.exe

pid	process
2916	b260c10711b68025524046ac35db73ad_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b260c10711b68025524046ac35db73ad_JaffaCakes118.exe

description	pid	process	target process
PID 2916 wrote to memory of 2748	2916	b260c10711b68025524046ac35db73ad_JaffaCakes118.exe	mobsync.exe
PID 2916 wrote to memory of 2748	2916	b260c10711b68025524046ac35db73ad_JaffaCakes118.exe	mobsync.exe
PID 2916 wrote to memory of 2748	2916	b260c10711b68025524046ac35db73ad_JaffaCakes118.exe	mobsync.exe
PID 2916 wrote to memory of 2748	2916	b260c10711b68025524046ac35db73ad_JaffaCakes118.exe	mobsync.exe

C:\Users\Admin\AppData\Local\Temp\b260c10711b68025524046ac35db73ad_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b260c10711b68025524046ac35db73ad_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2916

C:\Windows\SysWOW64\mfc110jpn\mobsync.exe
"C:\Windows\SysWOW64\mfc110jpn\mobsync.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2748

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mfc110jpn\mobsync.exe
Filesize
427KB

MD5
b260c10711b68025524046ac35db73ad

SHA1
17596e03dcd534d6f10061c8055d94b3973e108f

SHA256
4c4df0964e806a37f38f63c4eec8c5320639c93d943456c3aed7aec2f1f888d6

SHA512
36b391cadfbc5a99b63ab5c1eb5deb6239c5f0be1c2f12701f3175678b10024ba78080d05edcf1cbd5671fbf4476fb7b3f3765ed84f7146ad81c14fb2a5f4ad3

Download Submit
memory/2748-14-0x0000000000250000-0x0000000000260000-memory.dmp

Filesize
64KB

Download
memory/2748-15-0x0000000000250000-0x0000000000260000-memory.dmp

Filesize
64KB

Download
memory/2748-10-0x0000000000230000-0x0000000000242000-memory.dmp

Filesize
72KB

Download
memory/2916-7-0x00000000002F0000-0x00000000002FF000-memory.dmp

Filesize
60KB

Download
memory/2916-4-0x00000000002D0000-0x00000000002E0000-memory.dmp

Filesize
64KB

Download
memory/2916-0-0x00000000002B0000-0x00000000002C2000-memory.dmp

Filesize
72KB

Download
memory/2916-8-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download