emotet | 5493f7935a9ccade975afd856c5e1b39b23ef892931bd7176a585fae5212efbf

General

Target

58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe
Size

76KB
MD5

58e11fee744e81ae3109dd0552561219
SHA1

723e36d0e08e1360c6bbe01fadc741056982d839
SHA256

5493f7935a9ccade975afd856c5e1b39b23ef892931bd7176a585fae5212efbf
SHA512

c69dd203ceead30820c4646ab2c7570351cb4ff276af1dad38691fd096b5fe6448cf4f64504ab995a6accb1eae01369498a25c1af88daa2aa7a61038e7f7cb6d
SSDEEP

1536:TQuCvwbtQr8KUK980n2nrzbhSRYbpnKKEOvcFJB2JZBtpYknk+lk79:MwJQrXUu8BnrXUYREOvcJupYkk+

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 12 IoCs

Processes:

relatedsorting.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	relatedsorting.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	relatedsorting.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	relatedsorting.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	relatedsorting.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	relatedsorting.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464	relatedsorting.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464	relatedsorting.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	relatedsorting.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	relatedsorting.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	relatedsorting.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	relatedsorting.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	relatedsorting.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 9 IoCs

Processes:

relatedsorting.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	relatedsorting.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	relatedsorting.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	relatedsorting.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	relatedsorting.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	relatedsorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	relatedsorting.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	relatedsorting.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	relatedsorting.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	relatedsorting.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

relatedsorting.exe

pid	process
3572	relatedsorting.exe
3572	relatedsorting.exe
3572	relatedsorting.exe
3572	relatedsorting.exe
3572	relatedsorting.exe
3572	relatedsorting.exe
3572	relatedsorting.exe
3572	relatedsorting.exe
3572	relatedsorting.exe
3572	relatedsorting.exe
3572	relatedsorting.exe
3572	relatedsorting.exe
3572	relatedsorting.exe
3572	relatedsorting.exe
3572	relatedsorting.exe
3572	relatedsorting.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe

pid process

1548 58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe

pid	process
1548	58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

58e11fee744e81ae3109dd0552561219_JaffaCakes118.exerelatedsorting.exe

description	pid	process	target process
PID 3848 wrote to memory of 1548	3848	58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe	58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe
PID 3848 wrote to memory of 1548	3848	58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe	58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe
PID 3848 wrote to memory of 1548	3848	58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe	58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe
PID 4496 wrote to memory of 3572	4496	relatedsorting.exe	relatedsorting.exe
PID 4496 wrote to memory of 3572	4496	relatedsorting.exe	relatedsorting.exe
PID 4496 wrote to memory of 3572	4496	relatedsorting.exe	relatedsorting.exe

C:\Users\Admin\AppData\Local\Temp\58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3848

C:\Users\Admin\AppData\Local\Temp\58e11fee744e81ae3109dd0552561219_JaffaCakes118.exe
--4ca7df8e
2⤵
- Suspicious behavior: RenamesItself
PID:1548

C:\Windows\SysWOW64\relatedsorting.exe
"C:\Windows\SysWOW64\relatedsorting.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4496

C:\Windows\SysWOW64\relatedsorting.exe
--9d16522b
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3572

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1548-5-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1548-8-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1548-4-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/3572-12-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3572-10-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3572-11-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3572-13-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3572-15-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3572-17-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3572-24-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3572-26-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3572-27-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3572-29-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3848-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3848-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3848-0-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads