emotet | 832524de99f23137c29118cb38ec0d7c6a96e45e8e284a43a0fba8226d264c6c

General

Target

738888dc5167cf00fa86a6c0f6030544_JaffaCakes118.exe
Size

68KB
MD5

738888dc5167cf00fa86a6c0f6030544
SHA1

fec7c1bc79d4555f398efc62f4c341bd5842c57b
SHA256

832524de99f23137c29118cb38ec0d7c6a96e45e8e284a43a0fba8226d264c6c
SHA512

e3ed5a2c1783308925f29c02003401a1659d9362ad00e56b9c26b5aab9b413eb280a0a5c3a40a3f1dd20a18ec188a24c4f197a9042693cdc07dafa3299969302
SSDEEP

1536:YO+QeiPEN2aEevG+2DNhRcVjxjrlSX2Ur9nogm:YKeitZK4D7RcV9jr4X9lm

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

boostmnu.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	boostmnu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 19 IoCs

Processes:

boostmnu.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	boostmnu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D44AB461-88BF-42DF-BB67-38E36CE0C5A2}\e2-0d-f4-e0-01-b5	boostmnu.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e2-0d-f4-e0-01-b5\WpadDecision = "0"	boostmnu.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e2-0d-f4-e0-01-b5\WpadDecisionTime = 80c90731f7aeda01	boostmnu.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e2-0d-f4-e0-01-b5\WpadDetectedUrl	boostmnu.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	boostmnu.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	boostmnu.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	boostmnu.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D44AB461-88BF-42DF-BB67-38E36CE0C5A2}\WpadDecisionReason = "1"	boostmnu.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D44AB461-88BF-42DF-BB67-38E36CE0C5A2}\WpadNetworkName = "Network 3"	boostmnu.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e2-0d-f4-e0-01-b5\WpadDecisionReason = "1"	boostmnu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e2-0d-f4-e0-01-b5	boostmnu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	boostmnu.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	boostmnu.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0034000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	boostmnu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D44AB461-88BF-42DF-BB67-38E36CE0C5A2}	boostmnu.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D44AB461-88BF-42DF-BB67-38E36CE0C5A2}\WpadDecisionTime = 80c90731f7aeda01	boostmnu.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D44AB461-88BF-42DF-BB67-38E36CE0C5A2}\WpadDecision = "0"	boostmnu.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	boostmnu.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

738888dc5167cf00fa86a6c0f6030544_JaffaCakes118.exe738888dc5167cf00fa86a6c0f6030544_JaffaCakes118.exeboostmnu.exeboostmnu.exe

pid	process
2428	738888dc5167cf00fa86a6c0f6030544_JaffaCakes118.exe
2456	738888dc5167cf00fa86a6c0f6030544_JaffaCakes118.exe
2068	boostmnu.exe
2920	boostmnu.exe
2920	boostmnu.exe
2920	boostmnu.exe
2920	boostmnu.exe
2920	boostmnu.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

738888dc5167cf00fa86a6c0f6030544_JaffaCakes118.exe

pid process

2456 738888dc5167cf00fa86a6c0f6030544_JaffaCakes118.exe

pid	process
2456	738888dc5167cf00fa86a6c0f6030544_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

738888dc5167cf00fa86a6c0f6030544_JaffaCakes118.exeboostmnu.exe

description	pid	process	target process
PID 2428 wrote to memory of 2456	2428	738888dc5167cf00fa86a6c0f6030544_JaffaCakes118.exe	738888dc5167cf00fa86a6c0f6030544_JaffaCakes118.exe
PID 2428 wrote to memory of 2456	2428	738888dc5167cf00fa86a6c0f6030544_JaffaCakes118.exe	738888dc5167cf00fa86a6c0f6030544_JaffaCakes118.exe
PID 2428 wrote to memory of 2456	2428	738888dc5167cf00fa86a6c0f6030544_JaffaCakes118.exe	738888dc5167cf00fa86a6c0f6030544_JaffaCakes118.exe
PID 2428 wrote to memory of 2456	2428	738888dc5167cf00fa86a6c0f6030544_JaffaCakes118.exe	738888dc5167cf00fa86a6c0f6030544_JaffaCakes118.exe
PID 2068 wrote to memory of 2920	2068	boostmnu.exe	boostmnu.exe
PID 2068 wrote to memory of 2920	2068	boostmnu.exe	boostmnu.exe
PID 2068 wrote to memory of 2920	2068	boostmnu.exe	boostmnu.exe
PID 2068 wrote to memory of 2920	2068	boostmnu.exe	boostmnu.exe

C:\Users\Admin\AppData\Local\Temp\738888dc5167cf00fa86a6c0f6030544_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\738888dc5167cf00fa86a6c0f6030544_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2428

C:\Users\Admin\AppData\Local\Temp\738888dc5167cf00fa86a6c0f6030544_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\738888dc5167cf00fa86a6c0f6030544_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2456

C:\Windows\SysWOW64\boostmnu.exe
"C:\Windows\SysWOW64\boostmnu.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2068

C:\Windows\SysWOW64\boostmnu.exe
"C:\Windows\SysWOW64\boostmnu.exe"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2456-0-0x0000000000D70000-0x0000000000D87000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads