emotet | 158c8771c1d3130d43498978e80dacbd47c9337fc98b9f5a408439314f4cee6d

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-06-2024 01:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1049496ee9b11af0314d9d3d66a3e923_JaffaCakes118.exe
Size

104KB
MD5

1049496ee9b11af0314d9d3d66a3e923
SHA1

523e9665a9416852c4a5471c9e0673acce0c8c94
SHA256

158c8771c1d3130d43498978e80dacbd47c9337fc98b9f5a408439314f4cee6d
SHA512

32d41608e13a7e7fb701a834f1e1a7220bfa3fa3827cb6a0e9bdbaf00a0ffd83e94a5d9615b407fea8096f1d310e986bac0514ea5e2712c395673ec68c9dc7d7
SSDEEP

1536:39XM2K4Y3kK5MNq5cktsVPkRcT5nEYJyuXtg/I/rSLfrsSKPHRPmKJjrz3nYxh:398xkK5h5xwPDTZrJ/rqzsFjrz3nYxh

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

dmaguiddef.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	dmaguiddef.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	dmaguiddef.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	dmaguiddef.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	dmaguiddef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

dmaguiddef.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	dmaguiddef.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	dmaguiddef.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	dmaguiddef.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

dmaguiddef.exe

pid	process
1004	dmaguiddef.exe
1004	dmaguiddef.exe
1004	dmaguiddef.exe
1004	dmaguiddef.exe
1004	dmaguiddef.exe
1004	dmaguiddef.exe
1004	dmaguiddef.exe
1004	dmaguiddef.exe
1004	dmaguiddef.exe
1004	dmaguiddef.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

1049496ee9b11af0314d9d3d66a3e923_JaffaCakes118.exe

pid process

2172 1049496ee9b11af0314d9d3d66a3e923_JaffaCakes118.exe

pid	process
2172	1049496ee9b11af0314d9d3d66a3e923_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1049496ee9b11af0314d9d3d66a3e923_JaffaCakes118.exedmaguiddef.exe

description	pid	process	target process
PID 956 wrote to memory of 2172	956	1049496ee9b11af0314d9d3d66a3e923_JaffaCakes118.exe	1049496ee9b11af0314d9d3d66a3e923_JaffaCakes118.exe
PID 956 wrote to memory of 2172	956	1049496ee9b11af0314d9d3d66a3e923_JaffaCakes118.exe	1049496ee9b11af0314d9d3d66a3e923_JaffaCakes118.exe
PID 956 wrote to memory of 2172	956	1049496ee9b11af0314d9d3d66a3e923_JaffaCakes118.exe	1049496ee9b11af0314d9d3d66a3e923_JaffaCakes118.exe
PID 4328 wrote to memory of 1004	4328	dmaguiddef.exe	dmaguiddef.exe
PID 4328 wrote to memory of 1004	4328	dmaguiddef.exe	dmaguiddef.exe
PID 4328 wrote to memory of 1004	4328	dmaguiddef.exe	dmaguiddef.exe

C:\Users\Admin\AppData\Local\Temp\1049496ee9b11af0314d9d3d66a3e923_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1049496ee9b11af0314d9d3d66a3e923_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:956

C:\Users\Admin\AppData\Local\Temp\1049496ee9b11af0314d9d3d66a3e923_JaffaCakes118.exe
--c9639c92
2⤵
- Suspicious behavior: RenamesItself
PID:2172

C:\Windows\SysWOW64\dmaguiddef.exe
"C:\Windows\SysWOW64\dmaguiddef.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4328

C:\Windows\SysWOW64\dmaguiddef.exe
--a04fa8d6
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1004

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-0-0x0000000000590000-0x00000000005A1000-memory.dmp

Filesize
68KB

Download
memory/956-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/956-3-0x0000000000590000-0x00000000005A1000-memory.dmp

Filesize
68KB

Download
memory/1004-12-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1004-13-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1004-16-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1004-17-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2172-4-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2172-11-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4328-6-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download