emotet | 01034672f6dd779ef2c7a6f26bb815c64666d8036eb5ed7eac52dbbd6afd9771

General

Target

626e600948b08041891ee1a380263d21_JaffaCakes118.exe
Size

112KB
MD5

626e600948b08041891ee1a380263d21
SHA1

8acd56c7fc3f5992cc498e0b71c798c1c2813038
SHA256

01034672f6dd779ef2c7a6f26bb815c64666d8036eb5ed7eac52dbbd6afd9771
SHA512

fe490888edd3587bb9d19c7b5603ce49dde5400af636b41f393be2e1c9923f4028614972c31682b6c9ce783cada7f7fe085189f77ae9dceb19c81c86477bc636
SSDEEP

3072:5vDCGjODCKxSLKox1Xen3M0S58RXd8fym:5tjO+KxSzTu3lVQ

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

hotspotwhole.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	hotspotwhole.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

hotspotwhole.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-25-47-96-8f-13	hotspotwhole.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	hotspotwhole.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	hotspotwhole.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	hotspotwhole.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	hotspotwhole.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B510C714-0045-48B5-B1EF-713DAE6A7B30}	hotspotwhole.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B510C714-0045-48B5-B1EF-713DAE6A7B30}\WpadDecisionReason = "1"	hotspotwhole.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B510C714-0045-48B5-B1EF-713DAE6A7B30}\WpadNetworkName = "Network 3"	hotspotwhole.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-25-47-96-8f-13\WpadDecision = "0"	hotspotwhole.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	hotspotwhole.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	hotspotwhole.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	hotspotwhole.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00e9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	hotspotwhole.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B510C714-0045-48B5-B1EF-713DAE6A7B30}\WpadDecisionTime = 909055c456abda01	hotspotwhole.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B510C714-0045-48B5-B1EF-713DAE6A7B30}\8e-25-47-96-8f-13	hotspotwhole.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	hotspotwhole.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	hotspotwhole.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	hotspotwhole.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B510C714-0045-48B5-B1EF-713DAE6A7B30}\WpadDecision = "0"	hotspotwhole.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-25-47-96-8f-13\WpadDecisionReason = "1"	hotspotwhole.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-25-47-96-8f-13\WpadDecisionTime = 909055c456abda01	hotspotwhole.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

hotspotwhole.exe

pid process

2544 hotspotwhole.exe
2544 hotspotwhole.exe
2544 hotspotwhole.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

626e600948b08041891ee1a380263d21_JaffaCakes118.exe

pid process

3048 626e600948b08041891ee1a380263d21_JaffaCakes118.exe

pid	process
2544	hotspotwhole.exe
2544	hotspotwhole.exe
2544	hotspotwhole.exe

pid	process
3048	626e600948b08041891ee1a380263d21_JaffaCakes118.exe

Suspicious use of UnmapMainImage 4 IoCs

Processes:

626e600948b08041891ee1a380263d21_JaffaCakes118.exe626e600948b08041891ee1a380263d21_JaffaCakes118.exehotspotwhole.exehotspotwhole.exe

pid	process
2940	626e600948b08041891ee1a380263d21_JaffaCakes118.exe
3048	626e600948b08041891ee1a380263d21_JaffaCakes118.exe
3040	hotspotwhole.exe
2544	hotspotwhole.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

626e600948b08041891ee1a380263d21_JaffaCakes118.exehotspotwhole.exe

description	pid	process	target process
PID 2940 wrote to memory of 3048	2940	626e600948b08041891ee1a380263d21_JaffaCakes118.exe	626e600948b08041891ee1a380263d21_JaffaCakes118.exe
PID 2940 wrote to memory of 3048	2940	626e600948b08041891ee1a380263d21_JaffaCakes118.exe	626e600948b08041891ee1a380263d21_JaffaCakes118.exe
PID 2940 wrote to memory of 3048	2940	626e600948b08041891ee1a380263d21_JaffaCakes118.exe	626e600948b08041891ee1a380263d21_JaffaCakes118.exe
PID 2940 wrote to memory of 3048	2940	626e600948b08041891ee1a380263d21_JaffaCakes118.exe	626e600948b08041891ee1a380263d21_JaffaCakes118.exe
PID 3040 wrote to memory of 2544	3040	hotspotwhole.exe	hotspotwhole.exe
PID 3040 wrote to memory of 2544	3040	hotspotwhole.exe	hotspotwhole.exe
PID 3040 wrote to memory of 2544	3040	hotspotwhole.exe	hotspotwhole.exe
PID 3040 wrote to memory of 2544	3040	hotspotwhole.exe	hotspotwhole.exe

C:\Users\Admin\AppData\Local\Temp\626e600948b08041891ee1a380263d21_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\626e600948b08041891ee1a380263d21_JaffaCakes118.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2940

C:\Users\Admin\AppData\Local\Temp\626e600948b08041891ee1a380263d21_JaffaCakes118.exe
--e4571000
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:3048

C:\Windows\SysWOW64\hotspotwhole.exe
"C:\Windows\SysWOW64\hotspotwhole.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3040

C:\Windows\SysWOW64\hotspotwhole.exe
--bdb8bc9a
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2544-9-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2544-10-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2544-11-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2544-12-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2940-0-0x00000000001B0000-0x00000000001C1000-memory.dmp

Filesize
68KB

Download
memory/2940-2-0x00000000001B0000-0x00000000001C1000-memory.dmp

Filesize
68KB

Download
memory/2940-3-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3040-5-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3048-4-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3048-8-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads