emotet | c783c92b42ced4137905d7c65180c9de8732fc48a2923036aad4f704f9630d26

General

Target

b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe
Size

308KB
MD5

b73ff4bd2c42f3ae83e9a54dc961e775
SHA1

b42270c0fc8af3d8ec5209d03d48af1075d1c059
SHA256

c783c92b42ced4137905d7c65180c9de8732fc48a2923036aad4f704f9630d26
SHA512

d5531830e6c8f6c2a9956d62f3cadac081fcf0e935848625bd994ad94414ce57f22fdeb0bdd48ac83644c1b80df07044ade4714dfcd9012b1bc37a68c5c713b5
SSDEEP

3072:tCPATouZdBAm8u5qvwuNPQItC7iykMPNPLlEg56pnvhEPcz/sjxOZe5:MPCum81YIPQMCuyDDlB25y4Ze5

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

149.202.197.94:8080

139.162.75.91:8080

37.187.2.199:443

165.227.156.155:443

90.77.228.193:8090

67.225.179.64:8080

87.106.139.101:8080

191.92.209.110:7080

83.136.245.190:8080

65.23.154.17:8080

190.211.207.11:443

115.78.95.230:443

190.147.215.53:22

62.75.187.192:8080

173.249.47.77:8080

104.131.44.150:8080

190.145.67.134:8090

138.201.140.110:8080

103.39.131.88:80

80.11.163.139:21

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Drops file in System32 directory 1 IoCs

Processes:

memopdf.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat memopdf.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	memopdf.exe

Modifies data under HKEY_USERS 21 IoCs

Processes:

memopdf.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	memopdf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	memopdf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	memopdf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EBEE84DB-45DF-4703-AD8D-AB510DA632D1}\WpadDecisionReason = "1"	memopdf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-d9-22-a3-59-52\WpadDecisionTime = 70080fe681c0da01	memopdf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EBEE84DB-45DF-4703-AD8D-AB510DA632D1}\WpadNetworkName = "Network 3"	memopdf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-d9-22-a3-59-52	memopdf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	memopdf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	memopdf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	memopdf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	memopdf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	memopdf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f004c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	memopdf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EBEE84DB-45DF-4703-AD8D-AB510DA632D1}\WpadDecision = "0"	memopdf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EBEE84DB-45DF-4703-AD8D-AB510DA632D1}\96-d9-22-a3-59-52	memopdf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-d9-22-a3-59-52\WpadDecisionReason = "1"	memopdf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	memopdf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	memopdf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EBEE84DB-45DF-4703-AD8D-AB510DA632D1}	memopdf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EBEE84DB-45DF-4703-AD8D-AB510DA632D1}\WpadDecisionTime = 70080fe681c0da01	memopdf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-d9-22-a3-59-52\WpadDecision = "0"	memopdf.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

memopdf.exe

pid process

2632 memopdf.exe
2632 memopdf.exe
2632 memopdf.exe
2632 memopdf.exe
2632 memopdf.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe

pid process

2088 b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe

pid	process
2632	memopdf.exe
2632	memopdf.exe
2632	memopdf.exe
2632	memopdf.exe
2632	memopdf.exe

pid	process
2088	b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exememopdf.exe

description	pid	process	target process
PID 944 wrote to memory of 2088	944	b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe	b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe
PID 944 wrote to memory of 2088	944	b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe	b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe
PID 944 wrote to memory of 2088	944	b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe	b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe
PID 944 wrote to memory of 2088	944	b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe	b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe
PID 2068 wrote to memory of 2632	2068	memopdf.exe	memopdf.exe
PID 2068 wrote to memory of 2632	2068	memopdf.exe	memopdf.exe
PID 2068 wrote to memory of 2632	2068	memopdf.exe	memopdf.exe
PID 2068 wrote to memory of 2632	2068	memopdf.exe	memopdf.exe

C:\Users\Admin\AppData\Local\Temp\b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:944

C:\Users\Admin\AppData\Local\Temp\b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe
--50a68a18
2⤵
- Suspicious behavior: RenamesItself
PID:2088

C:\Windows\SysWOW64\memopdf.exe
"C:\Windows\SysWOW64\memopdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2068

C:\Windows\SysWOW64\memopdf.exe
--c4f7192e
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2632

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/944-0-0x00000000003E0000-0x00000000003F5000-memory.dmp

Filesize
84KB

Download
memory/944-5-0x0000000000250000-0x0000000000260000-memory.dmp

Filesize
64KB

Download
memory/2068-11-0x00000000002A0000-0x00000000002B5000-memory.dmp

Filesize
84KB

Download
memory/2088-6-0x0000000000230000-0x0000000000245000-memory.dmp

Filesize
84KB

Download
memory/2088-16-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2632-17-0x0000000000310000-0x0000000000325000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing