emotet | e94caa8cdf3f794d97a18f59742dcb3a546232dbed13c2ca919827cdf6c33235

General

Target

d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe
Size

496KB
MD5

d3fdb4f4f094b46baffb6bb84e918ed8
SHA1

0e194425e866ef211972c3b84c82464fd9ceb097
SHA256

e94caa8cdf3f794d97a18f59742dcb3a546232dbed13c2ca919827cdf6c33235
SHA512

abd1fc0a9ff2fa0f7931ae962ee693946e6a90f7b977a1172c93afecdb69ee81c52408d9a69df02226d53800ded01de7e6067c55b218b20fe77ea26601e61862
SSDEEP

3072:xlM+IdcIO0d4pnuGN1PN9QAAQ8RJiLU7kyw4m7yyf1li5wVGsd3rQhmNCTwkhzUB:xXUO0enRp5PYgyfK3AjhljW+leI

Score

10^/10

emotet banker discovery trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	orderediowa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	orderediowa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	orderediowa.exe

Modifies data under HKEY_USERS 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	orderediowa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ae-11-70-21-97-b6\WpadDecisionReason = "1"	orderediowa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ae-11-70-21-97-b6\WpadDecision = "0"	orderediowa.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ae-11-70-21-97-b6\WpadDetectedUrl	orderediowa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	orderediowa.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{41F30C3E-7A55-44EA-92F6-49C368D914CB}\WpadNetworkName = "Network 3"	orderediowa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	orderediowa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	orderediowa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	orderediowa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{41F30C3E-7A55-44EA-92F6-49C368D914CB}	orderediowa.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{41F30C3E-7A55-44EA-92F6-49C368D914CB}\WpadDecisionTime = 50be8d80cd01db01	orderediowa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{41F30C3E-7A55-44EA-92F6-49C368D914CB}\WpadDecision = "0"	orderediowa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ae-11-70-21-97-b6	orderediowa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{41F30C3E-7A55-44EA-92F6-49C368D914CB}\ae-11-70-21-97-b6	orderediowa.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	orderediowa.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	orderediowa.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	orderediowa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{41F30C3E-7A55-44EA-92F6-49C368D914CB}\WpadDecisionReason = "1"	orderediowa.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ae-11-70-21-97-b6\WpadDecisionTime = 50be8d80cd01db01	orderediowa.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2232	d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe
2572	d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe
288	orderediowa.exe
1980	orderediowa.exe
1980	orderediowa.exe
1980	orderediowa.exe
1980	orderediowa.exe
1980	orderediowa.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2572	d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2572	2232	d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe	31
PID 2232 wrote to memory of 2572	2232	d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe	31
PID 2232 wrote to memory of 2572	2232	d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe	31
PID 2232 wrote to memory of 2572	2232	d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe	31
PID 288 wrote to memory of 1980	288	orderediowa.exe	33
PID 288 wrote to memory of 1980	288	orderediowa.exe	33
PID 288 wrote to memory of 1980	288	orderediowa.exe	33
PID 288 wrote to memory of 1980	288	orderediowa.exe	33

C:\Users\Admin\AppData\Local\Temp\d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  PID:2572

C:\Windows\SysWOW64\orderediowa.exe
"C:\Windows\SysWOW64\orderediowa.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:288
- C:\Windows\SysWOW64\orderediowa.exe
  "C:\Windows\SysWOW64\orderediowa.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/288-19-0x0000000000330000-0x0000000000347000-memory.dmp

Filesize
92KB

Download
memory/288-21-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/288-20-0x0000000000300000-0x0000000000317000-memory.dmp

Filesize
92KB

Download
memory/288-15-0x0000000000330000-0x0000000000347000-memory.dmp

Filesize
92KB

Download
memory/1980-27-0x0000000000340000-0x0000000000357000-memory.dmp

Filesize
92KB

Download
memory/1980-22-0x0000000000320000-0x0000000000337000-memory.dmp

Filesize
92KB

Download
memory/1980-32-0x0000000000320000-0x0000000000337000-memory.dmp

Filesize
92KB

Download
memory/1980-23-0x0000000000340000-0x0000000000357000-memory.dmp

Filesize
92KB

Download
memory/1980-29-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/2232-0-0x00000000002F0000-0x0000000000307000-memory.dmp

Filesize
92KB

Download
memory/2232-6-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/2232-4-0x00000000002F0000-0x0000000000307000-memory.dmp

Filesize
92KB

Download
memory/2232-5-0x0000000000240000-0x0000000000257000-memory.dmp

Filesize
92KB

Download
memory/2232-12-0x0000000000240000-0x0000000000257000-memory.dmp

Filesize
92KB

Download
memory/2572-11-0x0000000000260000-0x0000000000277000-memory.dmp

Filesize
92KB

Download
memory/2572-7-0x0000000000260000-0x0000000000277000-memory.dmp

Filesize
92KB

Download
memory/2572-28-0x0000000000240000-0x0000000000257000-memory.dmp

Filesize
92KB

Download
memory/2572-14-0x0000000000280000-0x0000000000290000-memory.dmp

Filesize
64KB

Download
memory/2572-30-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2572-31-0x0000000000240000-0x0000000000257000-memory.dmp

Filesize
92KB

Download
memory/2572-13-0x0000000000240000-0x0000000000257000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing