emotet | 11dbb021b663c84e26663121e993e3384f793267426373e8e1b0e5d335fb22ba

General

Target

08dac7cd7811478ca3034abea01f7ef3_JaffaCakes118.exe
Size

120KB
MD5

08dac7cd7811478ca3034abea01f7ef3
SHA1

39fb4257800f4ea0225f5dbd3f6784148d8a0b35
SHA256

11dbb021b663c84e26663121e993e3384f793267426373e8e1b0e5d335fb22ba
SHA512

e17ce09a80f3141399a75ca7bba7f24d7a8f3b40cea23654b2cd6e94e3c854627c50acb23845e7a882d74abb94e4c400829183fd60af6c4851052fb9e4d58d52
SSDEEP

3072:jsSVfjdK41ap0intKLzKhiEQnE4qXYjXqX:jsSxw41aSitSOhiEQdAX

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	pinnedprompt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 25 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	pinnedprompt.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-3a-ff-9b-33-9c\WpadDecisionTime = 70e1fae8a89ada01	pinnedprompt.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{52762615-43A3-422F-A9D9-1D71310E9262}\WpadDecisionTime = b00d7025a99ada01	pinnedprompt.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	pinnedprompt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{52762615-43A3-422F-A9D9-1D71310E9262}\WpadDecision = "0"	pinnedprompt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-3a-ff-9b-33-9c\WpadDecision = "0"	pinnedprompt.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{52762615-43A3-422F-A9D9-1D71310E9262}\WpadDecisionTime = 70e1fae8a89ada01	pinnedprompt.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	pinnedprompt.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	pinnedprompt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-3a-ff-9b-33-9c	pinnedprompt.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	pinnedprompt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	pinnedprompt.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-3a-ff-9b-33-9c\WpadDetectedUrl	pinnedprompt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	pinnedprompt.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00eb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	pinnedprompt.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-3a-ff-9b-33-9c\WpadDecisionTime = b00d7025a99ada01	pinnedprompt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	pinnedprompt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-3a-ff-9b-33-9c\WpadDecisionReason = "1"	pinnedprompt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{52762615-43A3-422F-A9D9-1D71310E9262}\de-3a-ff-9b-33-9c	pinnedprompt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	pinnedprompt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{52762615-43A3-422F-A9D9-1D71310E9262}	pinnedprompt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{52762615-43A3-422F-A9D9-1D71310E9262}\WpadDecisionReason = "1"	pinnedprompt.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{52762615-43A3-422F-A9D9-1D71310E9262}\WpadNetworkName = "Network 3"	pinnedprompt.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00eb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	pinnedprompt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	pinnedprompt.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2768	pinnedprompt.exe
2768	pinnedprompt.exe
2768	pinnedprompt.exe
2768	pinnedprompt.exe
2768	pinnedprompt.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1680	08dac7cd7811478ca3034abea01f7ef3_JaffaCakes118.exe

Suspicious use of UnmapMainImage 4 IoCs

pid	Process
2944	08dac7cd7811478ca3034abea01f7ef3_JaffaCakes118.exe
1680	08dac7cd7811478ca3034abea01f7ef3_JaffaCakes118.exe
2624	pinnedprompt.exe
2768	pinnedprompt.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 1680	2944	08dac7cd7811478ca3034abea01f7ef3_JaffaCakes118.exe	28
PID 2944 wrote to memory of 1680	2944	08dac7cd7811478ca3034abea01f7ef3_JaffaCakes118.exe	28
PID 2944 wrote to memory of 1680	2944	08dac7cd7811478ca3034abea01f7ef3_JaffaCakes118.exe	28
PID 2944 wrote to memory of 1680	2944	08dac7cd7811478ca3034abea01f7ef3_JaffaCakes118.exe	28
PID 2624 wrote to memory of 2768	2624	pinnedprompt.exe	30
PID 2624 wrote to memory of 2768	2624	pinnedprompt.exe	30
PID 2624 wrote to memory of 2768	2624	pinnedprompt.exe	30
PID 2624 wrote to memory of 2768	2624	pinnedprompt.exe	30

C:\Users\Admin\AppData\Local\Temp\08dac7cd7811478ca3034abea01f7ef3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08dac7cd7811478ca3034abea01f7ef3_JaffaCakes118.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Users\Admin\AppData\Local\Temp\08dac7cd7811478ca3034abea01f7ef3_JaffaCakes118.exe
  --96f82519
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of UnmapMainImage
  PID:1680

C:\Windows\SysWOW64\pinnedprompt.exe
"C:\Windows\SysWOW64\pinnedprompt.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\pinnedprompt.exe
  --d79a1e8e
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1680-4-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1680-7-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2768-8-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2768-9-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2944-0-0x00000000002B0000-0x00000000002C1000-memory.dmp

Filesize
68KB

Download
memory/2944-3-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2944-2-0x00000000002B0000-0x00000000002C1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing