emotet | 5493f7935a9ccade975afd856c5e1b39b23ef892931bd7176a585fae5212efbf

General

Target

58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe
Size

76KB
MD5

58e11fee744e81ae3109dd0552561219
SHA1

723e36d0e08e1360c6bbe01fadc741056982d839
SHA256

5493f7935a9ccade975afd856c5e1b39b23ef892931bd7176a585fae5212efbf
SHA512

c69dd203ceead30820c4646ab2c7570351cb4ff276af1dad38691fd096b5fe6448cf4f64504ab995a6accb1eae01369498a25c1af88daa2aa7a61038e7f7cb6d
SSDEEP

1536:TQuCvwbtQr8KUK980n2nrzbhSRYbpnKKEOvcFJB2JZBtpYknk+lk79:MwJQrXUu8BnrXUYREOvcJupYkk+

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 5 IoCs

Processes:

titlesorting.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	titlesorting.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	titlesorting.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	titlesorting.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464	titlesorting.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464	titlesorting.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

Processes:

titlesorting.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	titlesorting.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	titlesorting.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{393578DA-4BD2-4131-B9A6-26075EF3E721}\WpadNetworkName = "Network 3"	titlesorting.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-1c-77-23-85-b9\WpadDecisionTime = 90b2bf7fb1a9da01	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	titlesorting.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	titlesorting.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0089000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	titlesorting.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	titlesorting.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-1c-77-23-85-b9\WpadDecisionReason = "1"	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	titlesorting.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	titlesorting.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0089000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{393578DA-4BD2-4131-B9A6-26075EF3E721}	titlesorting.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	titlesorting.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	titlesorting.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{393578DA-4BD2-4131-B9A6-26075EF3E721}\WpadDecisionReason = "1"	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-1c-77-23-85-b9	titlesorting.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{393578DA-4BD2-4131-B9A6-26075EF3E721}\WpadDecisionTime = f0d7f9a1b1a9da01	titlesorting.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-1c-77-23-85-b9\WpadDecisionTime = f0d7f9a1b1a9da01	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	titlesorting.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	titlesorting.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	titlesorting.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-1c-77-23-85-b9\WpadDecision = "0"	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	titlesorting.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{393578DA-4BD2-4131-B9A6-26075EF3E721}\WpadDecision = "0"	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	titlesorting.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-1c-77-23-85-b9\WpadDetectedUrl	titlesorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	titlesorting.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

titlesorting.exe

pid process

1116 titlesorting.exe
1116 titlesorting.exe
1116 titlesorting.exe
1116 titlesorting.exe
1116 titlesorting.exe
1116 titlesorting.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe

pid process

2208 58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe

pid	process
1116	titlesorting.exe
1116	titlesorting.exe
1116	titlesorting.exe
1116	titlesorting.exe
1116	titlesorting.exe
1116	titlesorting.exe

pid	process
2208	58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

58e11fee744e81ae3109dd0552561219_JaffaCakes118.exetitlesorting.exe

description	pid	process	target process
PID 2180 wrote to memory of 2208	2180	58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe	58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe
PID 2180 wrote to memory of 2208	2180	58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe	58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe
PID 2180 wrote to memory of 2208	2180	58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe	58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe
PID 2180 wrote to memory of 2208	2180	58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe	58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe
PID 2332 wrote to memory of 1116	2332	titlesorting.exe	titlesorting.exe
PID 2332 wrote to memory of 1116	2332	titlesorting.exe	titlesorting.exe
PID 2332 wrote to memory of 1116	2332	titlesorting.exe	titlesorting.exe
PID 2332 wrote to memory of 1116	2332	titlesorting.exe	titlesorting.exe

C:\Users\Admin\AppData\Local\Temp\58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180

C:\Users\Admin\AppData\Local\Temp\58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe
--4ca7df8e
2⤵
- Suspicious behavior: RenamesItself
PID:2208

C:\Windows\SysWOW64\titlesorting.exe
"C:\Windows\SysWOW64\titlesorting.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2332

C:\Windows\SysWOW64\titlesorting.exe
--ad0cf87e
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1116

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1116-19-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1116-14-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1116-31-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1116-30-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1116-12-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1116-23-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1116-15-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1116-11-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1116-13-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2180-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2180-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2180-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2180-3-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2208-4-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2208-9-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2332-6-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads