emotet | 3bc58bf535ac5b065fc08ac751c19e5e4d0d61042201e7f2938eb416e8a58be1

General

Target

57a8de378eca755ef3d46091a546280e_JaffaCakes118.exe
Size

191KB
MD5

57a8de378eca755ef3d46091a546280e
SHA1

ab462c6f884b7e652127720a25cdfa95e3c67058
SHA256

3bc58bf535ac5b065fc08ac751c19e5e4d0d61042201e7f2938eb416e8a58be1
SHA512

ca3f028c42d3b01594d037477d55602bc1890a69c1f51194db79e24a23442d323b3524c292c2357d5bc2851a48c2edb092e87b8fb3d7d481fffa2006de1dc4e3
SSDEEP

3072:Y1FX8gYZ4CeU23vpjY+cLB09fLRqooHH5m/+yA78d:Yr924C7kM+cLB0ZLRLQ5m5B

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

xinputnevada.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	xinputnevada.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 25 IoCs

Processes:

xinputnevada.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0026000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	xinputnevada.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	xinputnevada.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	xinputnevada.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BBA010D1-6925-4011-A9BE-2F3BBC9AB011}\WpadDecisionTime = e054f21984a9da01	xinputnevada.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BBA010D1-6925-4011-A9BE-2F3BBC9AB011}\WpadDecisionTime = c07c876d84a9da01	xinputnevada.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	xinputnevada.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BBA010D1-6925-4011-A9BE-2F3BBC9AB011}\WpadDecision = "0"	xinputnevada.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-a4-6c-d2-f4-72\WpadDecision = "0"	xinputnevada.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	xinputnevada.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	xinputnevada.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-a4-6c-d2-f4-72	xinputnevada.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-a4-6c-d2-f4-72\WpadDecisionTime = e054f21984a9da01	xinputnevada.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-a4-6c-d2-f4-72\WpadDetectedUrl	xinputnevada.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-a4-6c-d2-f4-72\WpadDecisionTime = c07c876d84a9da01	xinputnevada.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	xinputnevada.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	xinputnevada.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BBA010D1-6925-4011-A9BE-2F3BBC9AB011}\WpadDecisionReason = "1"	xinputnevada.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-a4-6c-d2-f4-72\WpadDecisionReason = "1"	xinputnevada.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BBA010D1-6925-4011-A9BE-2F3BBC9AB011}\WpadNetworkName = "Network 3"	xinputnevada.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BBA010D1-6925-4011-A9BE-2F3BBC9AB011}\52-a4-6c-d2-f4-72	xinputnevada.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	xinputnevada.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	xinputnevada.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0026000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	xinputnevada.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	xinputnevada.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BBA010D1-6925-4011-A9BE-2F3BBC9AB011}	xinputnevada.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

57a8de378eca755ef3d46091a546280e_JaffaCakes118.exe57a8de378eca755ef3d46091a546280e_JaffaCakes118.exexinputnevada.exexinputnevada.exe

pid	process
2284	57a8de378eca755ef3d46091a546280e_JaffaCakes118.exe
2972	57a8de378eca755ef3d46091a546280e_JaffaCakes118.exe
2640	xinputnevada.exe
2588	xinputnevada.exe
2588	xinputnevada.exe
2588	xinputnevada.exe
2588	xinputnevada.exe
2588	xinputnevada.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

57a8de378eca755ef3d46091a546280e_JaffaCakes118.exe

pid process

2972 57a8de378eca755ef3d46091a546280e_JaffaCakes118.exe

pid	process
2972	57a8de378eca755ef3d46091a546280e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

57a8de378eca755ef3d46091a546280e_JaffaCakes118.exexinputnevada.exe

description	pid	process	target process
PID 2284 wrote to memory of 2972	2284	57a8de378eca755ef3d46091a546280e_JaffaCakes118.exe	57a8de378eca755ef3d46091a546280e_JaffaCakes118.exe
PID 2284 wrote to memory of 2972	2284	57a8de378eca755ef3d46091a546280e_JaffaCakes118.exe	57a8de378eca755ef3d46091a546280e_JaffaCakes118.exe
PID 2284 wrote to memory of 2972	2284	57a8de378eca755ef3d46091a546280e_JaffaCakes118.exe	57a8de378eca755ef3d46091a546280e_JaffaCakes118.exe
PID 2284 wrote to memory of 2972	2284	57a8de378eca755ef3d46091a546280e_JaffaCakes118.exe	57a8de378eca755ef3d46091a546280e_JaffaCakes118.exe
PID 2640 wrote to memory of 2588	2640	xinputnevada.exe	xinputnevada.exe
PID 2640 wrote to memory of 2588	2640	xinputnevada.exe	xinputnevada.exe
PID 2640 wrote to memory of 2588	2640	xinputnevada.exe	xinputnevada.exe
PID 2640 wrote to memory of 2588	2640	xinputnevada.exe	xinputnevada.exe

C:\Users\Admin\AppData\Local\Temp\57a8de378eca755ef3d46091a546280e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\57a8de378eca755ef3d46091a546280e_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2284

C:\Users\Admin\AppData\Local\Temp\57a8de378eca755ef3d46091a546280e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\57a8de378eca755ef3d46091a546280e_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2972

C:\Windows\SysWOW64\xinputnevada.exe
"C:\Windows\SysWOW64\xinputnevada.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2640

C:\Windows\SysWOW64\xinputnevada.exe
"C:\Windows\SysWOW64\xinputnevada.exe"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2284-0-0x0000000000180000-0x000000000018D000-memory.dmp

Filesize
52KB

Download
memory/2284-5-0x0000000000190000-0x000000000019D000-memory.dmp

Filesize
52KB

Download
memory/2284-1-0x0000000000190000-0x000000000019D000-memory.dmp

Filesize
52KB

Download
memory/2284-6-0x00000000001A0000-0x00000000001B0000-memory.dmp

Filesize
64KB

Download
memory/2284-14-0x0000000000180000-0x000000000018D000-memory.dmp

Filesize
52KB

Download
memory/2588-32-0x0000000000100000-0x000000000010D000-memory.dmp

Filesize
52KB

Download
memory/2588-27-0x0000000000100000-0x000000000010D000-memory.dmp

Filesize
52KB

Download
memory/2588-28-0x00000000001B0000-0x00000000001C0000-memory.dmp

Filesize
64KB

Download
memory/2588-22-0x0000000000110000-0x000000000011D000-memory.dmp

Filesize
52KB

Download
memory/2588-26-0x0000000000110000-0x000000000011D000-memory.dmp

Filesize
52KB

Download
memory/2640-15-0x0000000000120000-0x000000000012D000-memory.dmp

Filesize
52KB

Download
memory/2640-21-0x0000000000130000-0x0000000000140000-memory.dmp

Filesize
64KB

Download
memory/2640-20-0x0000000000110000-0x000000000011D000-memory.dmp

Filesize
52KB

Download
memory/2640-19-0x0000000000120000-0x000000000012D000-memory.dmp

Filesize
52KB

Download
memory/2640-29-0x0000000000110000-0x000000000011D000-memory.dmp

Filesize
52KB

Download
memory/2972-13-0x00000000001E0000-0x00000000001F0000-memory.dmp

Filesize
64KB

Download
memory/2972-8-0x00000000001D0000-0x00000000001DD000-memory.dmp

Filesize
52KB

Download
memory/2972-12-0x00000000001D0000-0x00000000001DD000-memory.dmp

Filesize
52KB

Download
memory/2972-31-0x00000000000E0000-0x00000000000ED000-memory.dmp

Filesize
52KB

Download
memory/2972-30-0x0000000000E60000-0x0000000000E94000-memory.dmp

Filesize
208KB

Download
memory/2972-7-0x00000000000E0000-0x00000000000ED000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads