emotet | dea1aefd0b7f0ee52eae7ec1b488149e654903e99059514bbba09d5564717452

General

Target

d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe
Size

158KB
MD5

d11684c8498be98d2cd795e05861d605
SHA1

3ef9a26c9e0ac1e820baf5dc2d4b90f5fba1c65d
SHA256

dea1aefd0b7f0ee52eae7ec1b488149e654903e99059514bbba09d5564717452
SHA512

564a6a5180308098a5b2136ecb4814a4a2b92deea45122d134b7376ab8831a4e19dbfbe7eb57076792024e18ed615900c0f612a705c276c52f8a1810cd2e8484
SSDEEP

3072:VCT+m2JdQbyGkwGJ4EMsnCHDhYR9JbuEr06+BgSxPblSeZ2g+D84ESP:4Ty1XwAO+7

Score

10^/10

emotet banker discovery trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	singledasmrc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	singledasmrc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	singledasmrc.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{58595A50-B574-4237-BE1E-D766ABB7B897}\WpadDecisionTime = 2051ca7adf00db01	singledasmrc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{58595A50-B574-4237-BE1E-D766ABB7B897}\WpadDecision = "0"	singledasmrc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	singledasmrc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{58595A50-B574-4237-BE1E-D766ABB7B897}	singledasmrc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	singledasmrc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	singledasmrc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-42-4a-2e-87-c6	singledasmrc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	singledasmrc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	singledasmrc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-42-4a-2e-87-c6\WpadDecisionTime = 2051ca7adf00db01	singledasmrc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f012a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	singledasmrc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-42-4a-2e-87-c6\WpadDecisionReason = "1"	singledasmrc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{58595A50-B574-4237-BE1E-D766ABB7B897}\WpadDecisionReason = "1"	singledasmrc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{58595A50-B574-4237-BE1E-D766ABB7B897}\WpadNetworkName = "Network 3"	singledasmrc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{58595A50-B574-4237-BE1E-D766ABB7B897}\72-42-4a-2e-87-c6	singledasmrc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-42-4a-2e-87-c6\WpadDecision = "0"	singledasmrc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	singledasmrc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	singledasmrc.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2420	d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe
1704	d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe
2868	singledasmrc.exe
2860	singledasmrc.exe
2860	singledasmrc.exe
2860	singledasmrc.exe
2860	singledasmrc.exe
2860	singledasmrc.exe
2860	singledasmrc.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1704	d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1704	2420	d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe	29
PID 2420 wrote to memory of 1704	2420	d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe	29
PID 2420 wrote to memory of 1704	2420	d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe	29
PID 2420 wrote to memory of 1704	2420	d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe	29
PID 2868 wrote to memory of 2860	2868	singledasmrc.exe	31
PID 2868 wrote to memory of 2860	2868	singledasmrc.exe	31
PID 2868 wrote to memory of 2860	2868	singledasmrc.exe	31
PID 2868 wrote to memory of 2860	2868	singledasmrc.exe	31

C:\Users\Admin\AppData\Local\Temp\d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Users\Admin\AppData\Local\Temp\d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  PID:1704

C:\Windows\SysWOW64\singledasmrc.exe
"C:\Windows\SysWOW64\singledasmrc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\singledasmrc.exe
  "C:\Windows\SysWOW64\singledasmrc.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-10-0x00000000002F0000-0x000000000030A000-memory.dmp

Filesize
104KB

Download
memory/1704-29-0x00000000002D0000-0x00000000002EA000-memory.dmp

Filesize
104KB

Download
memory/1704-14-0x00000000002D0000-0x00000000002EA000-memory.dmp

Filesize
104KB

Download
memory/1704-13-0x0000000000310000-0x0000000000320000-memory.dmp

Filesize
64KB

Download
memory/1704-28-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1704-6-0x00000000002F0000-0x000000000030A000-memory.dmp

Filesize
104KB

Download
memory/2420-5-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2420-11-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/2420-4-0x00000000002F0000-0x000000000030A000-memory.dmp

Filesize
104KB

Download
memory/2420-12-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2420-0-0x00000000002F0000-0x000000000030A000-memory.dmp

Filesize
104KB

Download
memory/2860-26-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2860-27-0x0000000000280000-0x0000000000290000-memory.dmp

Filesize
64KB

Download
memory/2860-22-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2860-30-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download
memory/2868-19-0x00000000003A0000-0x00000000003BA000-memory.dmp

Filesize
104KB

Download
memory/2868-15-0x00000000003A0000-0x00000000003BA000-memory.dmp

Filesize
104KB

Download
memory/2868-21-0x00000000003C0000-0x00000000003D0000-memory.dmp

Filesize
64KB

Download
memory/2868-20-0x0000000000240000-0x000000000025A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing