emotet | c1b8175d273e0adcb61925a46e829cef90291a44c5a7a86c82a05dc42f0ae73d

General

Target

711b2ba3081b8a5f52e36bbaec636455_JaffaCakes118.exe
Size

346KB
MD5

711b2ba3081b8a5f52e36bbaec636455
SHA1

81b66bc82220bf78e4e89173f96f7288390ad1db
SHA256

c1b8175d273e0adcb61925a46e829cef90291a44c5a7a86c82a05dc42f0ae73d
SHA512

0d2321387afdb47f27e9776000c018733fdb9371e6a061d797512b0efd60222134db8f0f5246c24f53579f6c9926bf58910fbe76516bc64637a3a0a8f1073dbf
SSDEEP

3072:H3Vh8Z2IuSCe956HH8UiBIHm3mvQS0ghQ9QS789W5rQekiiL2isU2j2MmVsrKG+o:X0kQCS789W5cNi9U2j2MmVs

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

mfidladam.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mfidladam.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 18 IoCs

Processes:

mfidladam.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mfidladam.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7C858C43-4292-41AA-99F4-32E1CDB91BFF}\WpadNetworkName = "Network 3"	mfidladam.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-55-12-58-29-b7\WpadDecisionReason = "1"	mfidladam.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-55-12-58-29-b7\WpadDecision = "0"	mfidladam.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7C858C43-4292-41AA-99F4-32E1CDB91BFF}\WpadDecision = "0"	mfidladam.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-55-12-58-29-b7	mfidladam.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mfidladam.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mfidladam.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mfidladam.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mfidladam.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00e6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mfidladam.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7C858C43-4292-41AA-99F4-32E1CDB91BFF}\WpadDecisionTime = c07b71e86baeda01	mfidladam.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mfidladam.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mfidladam.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7C858C43-4292-41AA-99F4-32E1CDB91BFF}	mfidladam.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7C858C43-4292-41AA-99F4-32E1CDB91BFF}\WpadDecisionReason = "1"	mfidladam.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7C858C43-4292-41AA-99F4-32E1CDB91BFF}\66-55-12-58-29-b7	mfidladam.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-55-12-58-29-b7\WpadDecisionTime = c07b71e86baeda01	mfidladam.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

711b2ba3081b8a5f52e36bbaec636455_JaffaCakes118.exe711b2ba3081b8a5f52e36bbaec636455_JaffaCakes118.exemfidladam.exemfidladam.exe

pid	process
1964	711b2ba3081b8a5f52e36bbaec636455_JaffaCakes118.exe
2196	711b2ba3081b8a5f52e36bbaec636455_JaffaCakes118.exe
2616	mfidladam.exe
2560	mfidladam.exe
2560	mfidladam.exe
2560	mfidladam.exe
2560	mfidladam.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

711b2ba3081b8a5f52e36bbaec636455_JaffaCakes118.exe

pid process

2196 711b2ba3081b8a5f52e36bbaec636455_JaffaCakes118.exe

pid	process
2196	711b2ba3081b8a5f52e36bbaec636455_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

711b2ba3081b8a5f52e36bbaec636455_JaffaCakes118.exemfidladam.exe

description	pid	process	target process
PID 1964 wrote to memory of 2196	1964	711b2ba3081b8a5f52e36bbaec636455_JaffaCakes118.exe	711b2ba3081b8a5f52e36bbaec636455_JaffaCakes118.exe
PID 1964 wrote to memory of 2196	1964	711b2ba3081b8a5f52e36bbaec636455_JaffaCakes118.exe	711b2ba3081b8a5f52e36bbaec636455_JaffaCakes118.exe
PID 1964 wrote to memory of 2196	1964	711b2ba3081b8a5f52e36bbaec636455_JaffaCakes118.exe	711b2ba3081b8a5f52e36bbaec636455_JaffaCakes118.exe
PID 1964 wrote to memory of 2196	1964	711b2ba3081b8a5f52e36bbaec636455_JaffaCakes118.exe	711b2ba3081b8a5f52e36bbaec636455_JaffaCakes118.exe
PID 2616 wrote to memory of 2560	2616	mfidladam.exe	mfidladam.exe
PID 2616 wrote to memory of 2560	2616	mfidladam.exe	mfidladam.exe
PID 2616 wrote to memory of 2560	2616	mfidladam.exe	mfidladam.exe
PID 2616 wrote to memory of 2560	2616	mfidladam.exe	mfidladam.exe

C:\Users\Admin\AppData\Local\Temp\711b2ba3081b8a5f52e36bbaec636455_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\711b2ba3081b8a5f52e36bbaec636455_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1964

C:\Users\Admin\AppData\Local\Temp\711b2ba3081b8a5f52e36bbaec636455_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\711b2ba3081b8a5f52e36bbaec636455_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2196

C:\Windows\SysWOW64\mfidladam.exe
"C:\Windows\SysWOW64\mfidladam.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2616

C:\Windows\SysWOW64\mfidladam.exe
"C:\Windows\SysWOW64\mfidladam.exe"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1964-10-0x00000000001B0000-0x00000000001CA000-memory.dmp

Filesize
104KB

Download
memory/1964-11-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1964-0-0x0000000000280000-0x000000000029A000-memory.dmp

Filesize
104KB

Download
memory/1964-4-0x0000000000280000-0x000000000029A000-memory.dmp

Filesize
104KB

Download
memory/2196-28-0x0000000000220000-0x000000000023A000-memory.dmp

Filesize
104KB

Download
memory/2196-13-0x0000000000280000-0x0000000000290000-memory.dmp

Filesize
64KB

Download
memory/2196-12-0x0000000000220000-0x000000000023A000-memory.dmp

Filesize
104KB

Download
memory/2196-9-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2196-5-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2196-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2560-30-0x0000000000220000-0x000000000023A000-memory.dmp

Filesize
104KB

Download
memory/2560-29-0x0000000000220000-0x000000000023A000-memory.dmp

Filesize
104KB

Download
memory/2616-14-0x0000000000220000-0x000000000023A000-memory.dmp

Filesize
104KB

Download
memory/2616-26-0x0000000000220000-0x000000000023A000-memory.dmp

Filesize
104KB

Download
memory/2616-20-0x00000000003C0000-0x00000000003D0000-memory.dmp

Filesize
64KB

Download
memory/2616-15-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2616-19-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads