emotet | 5a7c73db481459cc5506fdb2a27dfb9621e26168eb0e2e273bc1acfe7bc420f2

General

Target

6920e9cada37481469643baa7005eb68_JaffaCakes118.exe
Size

172KB
MD5

6920e9cada37481469643baa7005eb68
SHA1

c523768f7c3ec497a7e1a083aa23e1a6f6bc7c28
SHA256

5a7c73db481459cc5506fdb2a27dfb9621e26168eb0e2e273bc1acfe7bc420f2
SHA512

76a57fc976d489ef1a84cc906b86be5d22d7c7a964e297cea3965d95b8d6c0eaa4fccbb89b28b3941b266a3d41ea44c9f2ab06b3a525ad87a99d8a89daa63a66
SSDEEP

3072:mBeoEepgjwqlRoSGuKrWVRCcd/xg5fnVVvJ221HCWY86bIWLu4Nrme/1Z:KE5NVJd/yf2M4

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

ipropwithout.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	ipropwithout.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 18 IoCs

Processes:

ipropwithout.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	ipropwithout.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ipropwithout.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{10A52142-7252-451C-97D7-325E0A5C3C76}	ipropwithout.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{10A52142-7252-451C-97D7-325E0A5C3C76}\WpadDecisionTime = 50020875a7acda01	ipropwithout.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ipropwithout.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-8f-56-e4-0d-35\WpadDecisionTime = 50020875a7acda01	ipropwithout.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ipropwithout.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{10A52142-7252-451C-97D7-325E0A5C3C76}\WpadDecisionReason = "1"	ipropwithout.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{10A52142-7252-451C-97D7-325E0A5C3C76}\WpadDecision = "0"	ipropwithout.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{10A52142-7252-451C-97D7-325E0A5C3C76}\WpadNetworkName = "Network 3"	ipropwithout.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-8f-56-e4-0d-35\WpadDecision = "0"	ipropwithout.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00cc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ipropwithout.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ipropwithout.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	ipropwithout.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-8f-56-e4-0d-35	ipropwithout.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{10A52142-7252-451C-97D7-325E0A5C3C76}\86-8f-56-e4-0d-35	ipropwithout.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-8f-56-e4-0d-35\WpadDecisionReason = "1"	ipropwithout.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	ipropwithout.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

6920e9cada37481469643baa7005eb68_JaffaCakes118.exe6920e9cada37481469643baa7005eb68_JaffaCakes118.exeipropwithout.exeipropwithout.exe

pid	process
1860	6920e9cada37481469643baa7005eb68_JaffaCakes118.exe
1980	6920e9cada37481469643baa7005eb68_JaffaCakes118.exe
2656	ipropwithout.exe
2736	ipropwithout.exe
2736	ipropwithout.exe
2736	ipropwithout.exe
2736	ipropwithout.exe
2736	ipropwithout.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

6920e9cada37481469643baa7005eb68_JaffaCakes118.exe

pid process

1980 6920e9cada37481469643baa7005eb68_JaffaCakes118.exe

pid	process
1980	6920e9cada37481469643baa7005eb68_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

6920e9cada37481469643baa7005eb68_JaffaCakes118.exeipropwithout.exe

description	pid	process	target process
PID 1860 wrote to memory of 1980	1860	6920e9cada37481469643baa7005eb68_JaffaCakes118.exe	6920e9cada37481469643baa7005eb68_JaffaCakes118.exe
PID 1860 wrote to memory of 1980	1860	6920e9cada37481469643baa7005eb68_JaffaCakes118.exe	6920e9cada37481469643baa7005eb68_JaffaCakes118.exe
PID 1860 wrote to memory of 1980	1860	6920e9cada37481469643baa7005eb68_JaffaCakes118.exe	6920e9cada37481469643baa7005eb68_JaffaCakes118.exe
PID 1860 wrote to memory of 1980	1860	6920e9cada37481469643baa7005eb68_JaffaCakes118.exe	6920e9cada37481469643baa7005eb68_JaffaCakes118.exe
PID 2656 wrote to memory of 2736	2656	ipropwithout.exe	ipropwithout.exe
PID 2656 wrote to memory of 2736	2656	ipropwithout.exe	ipropwithout.exe
PID 2656 wrote to memory of 2736	2656	ipropwithout.exe	ipropwithout.exe
PID 2656 wrote to memory of 2736	2656	ipropwithout.exe	ipropwithout.exe

C:\Users\Admin\AppData\Local\Temp\6920e9cada37481469643baa7005eb68_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6920e9cada37481469643baa7005eb68_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1860

C:\Users\Admin\AppData\Local\Temp\6920e9cada37481469643baa7005eb68_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6920e9cada37481469643baa7005eb68_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:1980

C:\Windows\SysWOW64\ipropwithout.exe
"C:\Windows\SysWOW64\ipropwithout.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2656

C:\Windows\SysWOW64\ipropwithout.exe
"C:\Windows\SysWOW64\ipropwithout.exe"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2736

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1860-11-0x0000000000450000-0x0000000000470000-memory.dmp

Filesize
128KB

Download
memory/1860-10-0x00000000003E0000-0x00000000003FA000-memory.dmp

Filesize
104KB

Download
memory/1860-4-0x0000000000430000-0x000000000044A000-memory.dmp

Filesize
104KB

Download
memory/1860-0-0x0000000000430000-0x000000000044A000-memory.dmp

Filesize
104KB

Download
memory/1860-30-0x0000000000450000-0x0000000000470000-memory.dmp

Filesize
128KB

Download
memory/1980-29-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/1980-13-0x00000000002A0000-0x00000000002C0000-memory.dmp

Filesize
128KB

Download
memory/1980-12-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/1980-5-0x0000000000280000-0x000000000029A000-memory.dmp

Filesize
104KB

Download
memory/1980-28-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1980-9-0x0000000000280000-0x000000000029A000-memory.dmp

Filesize
104KB

Download
memory/2656-19-0x0000000000300000-0x000000000031A000-memory.dmp

Filesize
104KB

Download
memory/2656-20-0x00000000003E0000-0x0000000000400000-memory.dmp

Filesize
128KB

Download
memory/2656-18-0x00000000003C0000-0x00000000003DA000-memory.dmp

Filesize
104KB

Download
memory/2656-15-0x00000000003C0000-0x00000000003DA000-memory.dmp

Filesize
104KB

Download
memory/2736-21-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2736-27-0x0000000000280000-0x00000000002A0000-memory.dmp

Filesize
128KB

Download
memory/2736-26-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2736-25-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2736-31-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads