emotet | 54adef08f021ec453967e747e89be37e3ae5ce70d3834fb89854ff560ed4d6ad

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 23:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
298c6ee6d46e21f9aa072ad2c800bb33_JaffaCakes118.exe
Size 113KB
Sample240706-26ryrayekd
SHA256 54adef08f021ec453967e747e89be37e3ae5ce70d3834fb89854ff560ed4d6ad
MD5 298c6ee6d46e21f9aa072ad2c800bb33
SHA1 ec107ac25dd57576b01b8a3be83a1c1250d6fb16
SHA512 773b124b69ff081031cc409dbe7bd5cd98d38b5e95d1a9d3ece96e08633d98eed5463b6eb9696c3164286d7a768b87057015834c500096bc15d5ba81bb636f85
SSDEEP 1536:Ov6Rx3EQR3Mp5UXir1UBbaWzSVvplvCk+mhdIyOHrgZJcafAMkYEImwC0:OvU359Mp6w1aazRDKuO2bk9ImwC0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	thunkwgx.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	thunkwgx.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	thunkwgx.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	thunkwgx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	thunkwgx.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	thunkwgx.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	thunkwgx.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2804	298c6ee6d46e21f9aa072ad2c800bb33_JaffaCakes118.exe
2804	298c6ee6d46e21f9aa072ad2c800bb33_JaffaCakes118.exe
4664	298c6ee6d46e21f9aa072ad2c800bb33_JaffaCakes118.exe
4664	298c6ee6d46e21f9aa072ad2c800bb33_JaffaCakes118.exe
2528	thunkwgx.exe
2528	thunkwgx.exe
4332	thunkwgx.exe
4332	thunkwgx.exe
4332	thunkwgx.exe
4332	thunkwgx.exe
4332	thunkwgx.exe
4332	thunkwgx.exe
4332	thunkwgx.exe
4332	thunkwgx.exe
4332	thunkwgx.exe
4332	thunkwgx.exe
4332	thunkwgx.exe
4332	thunkwgx.exe
4332	thunkwgx.exe
4332	thunkwgx.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4664	298c6ee6d46e21f9aa072ad2c800bb33_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 4664	2804	298c6ee6d46e21f9aa072ad2c800bb33_JaffaCakes118.exe	85
PID 2804 wrote to memory of 4664	2804	298c6ee6d46e21f9aa072ad2c800bb33_JaffaCakes118.exe	85
PID 2804 wrote to memory of 4664	2804	298c6ee6d46e21f9aa072ad2c800bb33_JaffaCakes118.exe	85
PID 2528 wrote to memory of 4332	2528	thunkwgx.exe	87
PID 2528 wrote to memory of 4332	2528	thunkwgx.exe	87
PID 2528 wrote to memory of 4332	2528	thunkwgx.exe	87

C:\Users\Admin\AppData\Local\Temp\298c6ee6d46e21f9aa072ad2c800bb33_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\298c6ee6d46e21f9aa072ad2c800bb33_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Users\Admin\AppData\Local\Temp\298c6ee6d46e21f9aa072ad2c800bb33_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\298c6ee6d46e21f9aa072ad2c800bb33_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  PID:4664

C:\Windows\SysWOW64\thunkwgx.exe
"C:\Windows\SysWOW64\thunkwgx.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\thunkwgx.exe
  "C:\Windows\SysWOW64\thunkwgx.exe"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2528-7-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/2528-8-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/2804-0-0x00000000006C0000-0x00000000006D2000-memory.dmp

Download

memory/2804-1-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2804-6-0x00000000006C0000-0x00000000006D2000-memory.dmp

Download

memory/4332-9-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4332-12-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4332-17-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4332-18-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4664-2-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4664-4-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4664-13-0x0000000000400000-0x0000000000415000-memory.dmp

Download