emotet | 67001f1c08635f7e1b60359d7a6d9cb434609ba706c46bb976692958cc7ff3ef

Analysis

max time kernel
130s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 01:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0be35bf9a73b075168b115383cc3820b_JaffaCakes118.exe
Size 244KB
Sample240625-b8tl9athlc
SHA256 67001f1c08635f7e1b60359d7a6d9cb434609ba706c46bb976692958cc7ff3ef
MD5 0be35bf9a73b075168b115383cc3820b
SHA1 007f47a16f2eab9393791a2b2e3df312acad185e
SHA512 0a521db060fbe97d316e32fabc655e7a2bc80b31116ffe2501e8f87b292f135b2486204444af6e6e915c0b04c0cc82508a3e101201a150cde104341c92a33153
SSDEEP 3072:/6nl1RuGUvgeg55WRYrp3s9W3Heu65IZwC/6:yn7rUvTGBp3qW3Heij/6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	adminmouse.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	adminmouse.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	adminmouse.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	adminmouse.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	adminmouse.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	adminmouse.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	adminmouse.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4572	0be35bf9a73b075168b115383cc3820b_JaffaCakes118.exe
4572	0be35bf9a73b075168b115383cc3820b_JaffaCakes118.exe
3272	0be35bf9a73b075168b115383cc3820b_JaffaCakes118.exe
3272	0be35bf9a73b075168b115383cc3820b_JaffaCakes118.exe
2340	adminmouse.exe
2340	adminmouse.exe
5000	adminmouse.exe
5000	adminmouse.exe
5000	adminmouse.exe
5000	adminmouse.exe
5000	adminmouse.exe
5000	adminmouse.exe
5000	adminmouse.exe
5000	adminmouse.exe
5000	adminmouse.exe
5000	adminmouse.exe
5000	adminmouse.exe
5000	adminmouse.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3272	0be35bf9a73b075168b115383cc3820b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 3272	4572	0be35bf9a73b075168b115383cc3820b_JaffaCakes118.exe	81
PID 4572 wrote to memory of 3272	4572	0be35bf9a73b075168b115383cc3820b_JaffaCakes118.exe	81
PID 4572 wrote to memory of 3272	4572	0be35bf9a73b075168b115383cc3820b_JaffaCakes118.exe	81
PID 2340 wrote to memory of 5000	2340	adminmouse.exe	83
PID 2340 wrote to memory of 5000	2340	adminmouse.exe	83
PID 2340 wrote to memory of 5000	2340	adminmouse.exe	83

C:\Users\Admin\AppData\Local\Temp\0be35bf9a73b075168b115383cc3820b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0be35bf9a73b075168b115383cc3820b_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Users\Admin\AppData\Local\Temp\0be35bf9a73b075168b115383cc3820b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0be35bf9a73b075168b115383cc3820b_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  PID:3272

C:\Windows\SysWOW64\adminmouse.exe
"C:\Windows\SysWOW64\adminmouse.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\adminmouse.exe
  "C:\Windows\SysWOW64\adminmouse.exe"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2340-6-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3272-2-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3272-5-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/3272-10-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4572-0-0x00000000005C0000-0x00000000005D2000-memory.dmp

Download

memory/4572-1-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4572-4-0x00000000005C0000-0x00000000005D2000-memory.dmp

Download

memory/5000-7-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5000-8-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5000-11-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5000-12-0x0000000000400000-0x000000000043F000-memory.dmp

Download