emotet | dea1aefd0b7f0ee52eae7ec1b488149e654903e99059514bbba09d5564717452

General

Target

d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe
Size

158KB
MD5

d11684c8498be98d2cd795e05861d605
SHA1

3ef9a26c9e0ac1e820baf5dc2d4b90f5fba1c65d
SHA256

dea1aefd0b7f0ee52eae7ec1b488149e654903e99059514bbba09d5564717452
SHA512

564a6a5180308098a5b2136ecb4814a4a2b92deea45122d134b7376ab8831a4e19dbfbe7eb57076792024e18ed615900c0f612a705c276c52f8a1810cd2e8484
SSDEEP

3072:VCT+m2JdQbyGkwGJ4EMsnCHDhYR9JbuEr06+BgSxPblSeZ2g+D84ESP:4Ty1XwAO+7

Score

10^/10

emotet banker discovery trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dafguids.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dafguids.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3184	d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe
3184	d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe
3828	d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe
3828	d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe
436	dafguids.exe
436	dafguids.exe
3988	dafguids.exe
3988	dafguids.exe
3988	dafguids.exe
3988	dafguids.exe
3988	dafguids.exe
3988	dafguids.exe
3988	dafguids.exe
3988	dafguids.exe
3988	dafguids.exe
3988	dafguids.exe
3988	dafguids.exe
3988	dafguids.exe
3988	dafguids.exe
3988	dafguids.exe
3988	dafguids.exe
3988	dafguids.exe
3988	dafguids.exe
3988	dafguids.exe
3988	dafguids.exe
3988	dafguids.exe
3988	dafguids.exe
3988	dafguids.exe
3988	dafguids.exe
3988	dafguids.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3828	d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 3828	3184	d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe	83
PID 3184 wrote to memory of 3828	3184	d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe	83
PID 3184 wrote to memory of 3828	3184	d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe	83
PID 436 wrote to memory of 3988	436	dafguids.exe	94
PID 436 wrote to memory of 3988	436	dafguids.exe	94
PID 436 wrote to memory of 3988	436	dafguids.exe	94

C:\Users\Admin\AppData\Local\Temp\d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Users\Admin\AppData\Local\Temp\d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d11684c8498be98d2cd795e05861d605_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  PID:3828

C:\Windows\SysWOW64\dafguids.exe
"C:\Windows\SysWOW64\dafguids.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:436
- C:\Windows\SysWOW64\dafguids.exe
  "C:\Windows\SysWOW64\dafguids.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/436-20-0x00000000008D0000-0x00000000008EA000-memory.dmp

Filesize
104KB

Download
memory/436-30-0x00000000008B0000-0x00000000008CA000-memory.dmp

Filesize
104KB

Download
memory/436-16-0x00000000008D0000-0x00000000008EA000-memory.dmp

Filesize
104KB

Download
memory/436-22-0x00000000008F0000-0x0000000000900000-memory.dmp

Filesize
64KB

Download
memory/436-15-0x00000000008B0000-0x00000000008CA000-memory.dmp

Filesize
104KB

Download
memory/3184-6-0x00000000021E0000-0x00000000021F0000-memory.dmp

Filesize
64KB

Download
memory/3184-5-0x00000000021A0000-0x00000000021BA000-memory.dmp

Filesize
104KB

Download
memory/3184-0-0x00000000021C0000-0x00000000021DA000-memory.dmp

Filesize
104KB

Download
memory/3184-4-0x00000000021C0000-0x00000000021DA000-memory.dmp

Filesize
104KB

Download
memory/3184-14-0x00000000021A0000-0x00000000021BA000-memory.dmp

Filesize
104KB

Download
memory/3828-12-0x00000000006B0000-0x00000000006CA000-memory.dmp

Filesize
104KB

Download
memory/3828-7-0x00000000006E0000-0x00000000006FA000-memory.dmp

Filesize
104KB

Download
memory/3828-21-0x00000000006B0000-0x00000000006CA000-memory.dmp

Filesize
104KB

Download
memory/3828-11-0x00000000006E0000-0x00000000006FA000-memory.dmp

Filesize
104KB

Download
memory/3828-13-0x0000000000700000-0x0000000000710000-memory.dmp

Filesize
64KB

Download
memory/3828-31-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3828-32-0x00000000006B0000-0x00000000006CA000-memory.dmp

Filesize
104KB

Download
memory/3988-24-0x00000000005C0000-0x00000000005DA000-memory.dmp

Filesize
104KB

Download
memory/3988-28-0x00000000005C0000-0x00000000005DA000-memory.dmp

Filesize
104KB

Download
memory/3988-29-0x00000000006F0000-0x0000000000700000-memory.dmp

Filesize
64KB

Download
memory/3988-23-0x00000000005A0000-0x00000000005BA000-memory.dmp

Filesize
104KB

Download
memory/3988-33-0x00000000005A0000-0x00000000005BA000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing