emotet | c783c92b42ced4137905d7c65180c9de8732fc48a2923036aad4f704f9630d26

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17-06-2024 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe
Size

308KB
MD5

b73ff4bd2c42f3ae83e9a54dc961e775
SHA1

b42270c0fc8af3d8ec5209d03d48af1075d1c059
SHA256

c783c92b42ced4137905d7c65180c9de8732fc48a2923036aad4f704f9630d26
SHA512

d5531830e6c8f6c2a9956d62f3cadac081fcf0e935848625bd994ad94414ce57f22fdeb0bdd48ac83644c1b80df07044ade4714dfcd9012b1bc37a68c5c713b5
SSDEEP

3072:tCPATouZdBAm8u5qvwuNPQItC7iykMPNPLlEg56pnvhEPcz/sjxOZe5:MPCum81YIPQMCuyDDlB25y4Ze5

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

149.202.197.94:8080

139.162.75.91:8080

37.187.2.199:443

165.227.156.155:443

90.77.228.193:8090

67.225.179.64:8080

87.106.139.101:8080

191.92.209.110:7080

83.136.245.190:8080

65.23.154.17:8080

190.211.207.11:443

115.78.95.230:443

190.147.215.53:22

62.75.187.192:8080

173.249.47.77:8080

104.131.44.150:8080

190.145.67.134:8090

138.201.140.110:8080

103.39.131.88:80

80.11.163.139:21

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

wrapwsa.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	wrapwsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	wrapwsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	wrapwsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	wrapwsa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

wrapwsa.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	wrapwsa.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	wrapwsa.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	wrapwsa.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

wrapwsa.exe

pid	process
1560	wrapwsa.exe
1560	wrapwsa.exe
1560	wrapwsa.exe
1560	wrapwsa.exe
1560	wrapwsa.exe
1560	wrapwsa.exe
1560	wrapwsa.exe
1560	wrapwsa.exe
1560	wrapwsa.exe
1560	wrapwsa.exe
1560	wrapwsa.exe
1560	wrapwsa.exe
1560	wrapwsa.exe
1560	wrapwsa.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe

pid process

4104 b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe

pid	process
4104	b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exewrapwsa.exe

description	pid	process	target process
PID 4252 wrote to memory of 4104	4252	b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe	b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe
PID 4252 wrote to memory of 4104	4252	b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe	b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe
PID 4252 wrote to memory of 4104	4252	b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe	b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe
PID 3728 wrote to memory of 1560	3728	wrapwsa.exe	wrapwsa.exe
PID 3728 wrote to memory of 1560	3728	wrapwsa.exe	wrapwsa.exe
PID 3728 wrote to memory of 1560	3728	wrapwsa.exe	wrapwsa.exe

C:\Users\Admin\AppData\Local\Temp\b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4252

C:\Users\Admin\AppData\Local\Temp\b73ff4bd2c42f3ae83e9a54dc961e775_JaffaCakes118.exe
--50a68a18
2⤵
- Suspicious behavior: RenamesItself
PID:4104

C:\Windows\SysWOW64\wrapwsa.exe
"C:\Windows\SysWOW64\wrapwsa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3728

C:\Windows\SysWOW64\wrapwsa.exe
--5a5c2451
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1560

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\810077f5bbf3ff29a811eaffcf25df49_6b8fed25-7af2-4faa-8715-fe0b598ba931
Filesize
50B

MD5
96cbe736282c499a24b063fb66e1da22

SHA1
baa5bcc62c469b7f6d0b459f17cb6fcb8b35a300

SHA256
044e03d289dab3cac16b897753db443f1e6c00fc2de84c1a9239590f1becba92

SHA512
b3f602e0d9f9b1f8daed78c92776251f86cc45b07f162d77314777c32228d921d5a4219f05eb312f840963df0040441106d387351525465347f7f4088e4fbb92

Download Submit
memory/1560-20-0x00000000006F0000-0x0000000000705000-memory.dmp

Filesize
84KB

Download
memory/3728-12-0x0000000000EC0000-0x0000000000ED5000-memory.dmp

Filesize
84KB

Download
memory/4104-6-0x00000000020A0000-0x00000000020B5000-memory.dmp

Filesize
84KB

Download
memory/4104-17-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4252-5-0x00000000021E0000-0x00000000021F0000-memory.dmp

Filesize
64KB

Download
memory/4252-0-0x00000000021F0000-0x0000000002205000-memory.dmp

Filesize
84KB

Download