emotet | e94caa8cdf3f794d97a18f59742dcb3a546232dbed13c2ca919827cdf6c33235

General

Target

d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe
Size

496KB
MD5

d3fdb4f4f094b46baffb6bb84e918ed8
SHA1

0e194425e866ef211972c3b84c82464fd9ceb097
SHA256

e94caa8cdf3f794d97a18f59742dcb3a546232dbed13c2ca919827cdf6c33235
SHA512

abd1fc0a9ff2fa0f7931ae962ee693946e6a90f7b977a1172c93afecdb69ee81c52408d9a69df02226d53800ded01de7e6067c55b218b20fe77ea26601e61862
SSDEEP

3072:xlM+IdcIO0d4pnuGN1PN9QAAQ8RJiLU7kyw4m7yyf1li5wVGsd3rQhmNCTwkhzUB:xXUO0enRp5PYgyfK3AjhljW+leI

Score

10^/10

emotet banker discovery trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dynamicconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dynamicconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4832	d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe
4832	d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe
4292	d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe
4292	d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe
4460	dynamicconv.exe
4460	dynamicconv.exe
896	dynamicconv.exe
896	dynamicconv.exe
896	dynamicconv.exe
896	dynamicconv.exe
896	dynamicconv.exe
896	dynamicconv.exe
896	dynamicconv.exe
896	dynamicconv.exe
896	dynamicconv.exe
896	dynamicconv.exe
896	dynamicconv.exe
896	dynamicconv.exe
896	dynamicconv.exe
896	dynamicconv.exe
896	dynamicconv.exe
896	dynamicconv.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4292	d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 4292	4832	d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe	90
PID 4832 wrote to memory of 4292	4832	d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe	90
PID 4832 wrote to memory of 4292	4832	d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe	90
PID 4460 wrote to memory of 896	4460	dynamicconv.exe	97
PID 4460 wrote to memory of 896	4460	dynamicconv.exe	97
PID 4460 wrote to memory of 896	4460	dynamicconv.exe	97

C:\Users\Admin\AppData\Local\Temp\d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Users\Admin\AppData\Local\Temp\d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d3fdb4f4f094b46baffb6bb84e918ed8_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  PID:4292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4048,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
1⤵
PID:728

C:\Windows\SysWOW64\dynamicconv.exe
"C:\Windows\SysWOW64\dynamicconv.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\SysWOW64\dynamicconv.exe
  "C:\Windows\SysWOW64\dynamicconv.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/896-23-0x0000000000D60000-0x0000000000D77000-memory.dmp

Filesize
92KB

Download
memory/896-33-0x0000000000D60000-0x0000000000D77000-memory.dmp

Filesize
92KB

Download
memory/896-28-0x0000000000D80000-0x0000000000D97000-memory.dmp

Filesize
92KB

Download
memory/896-29-0x0000000000DA0000-0x0000000000DB0000-memory.dmp

Filesize
64KB

Download
memory/896-24-0x0000000000D80000-0x0000000000D97000-memory.dmp

Filesize
92KB

Download
memory/4292-12-0x0000000000550000-0x0000000000567000-memory.dmp

Filesize
92KB

Download
memory/4292-22-0x0000000000530000-0x0000000000547000-memory.dmp

Filesize
92KB

Download
memory/4292-13-0x0000000000570000-0x0000000000580000-memory.dmp

Filesize
64KB

Download
memory/4292-31-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4292-32-0x0000000000530000-0x0000000000547000-memory.dmp

Filesize
92KB

Download
memory/4292-9-0x0000000000550000-0x0000000000567000-memory.dmp

Filesize
92KB

Download
memory/4292-7-0x0000000000530000-0x0000000000547000-memory.dmp

Filesize
92KB

Download
memory/4460-20-0x0000000000D70000-0x0000000000D87000-memory.dmp

Filesize
92KB

Download
memory/4460-15-0x0000000000D90000-0x0000000000DA7000-memory.dmp

Filesize
92KB

Download
memory/4460-19-0x0000000000D90000-0x0000000000DA7000-memory.dmp

Filesize
92KB

Download
memory/4460-30-0x0000000000D70000-0x0000000000D87000-memory.dmp

Filesize
92KB

Download
memory/4460-21-0x00000000005E0000-0x00000000005F0000-memory.dmp

Filesize
64KB

Download
memory/4832-0-0x00000000021E0000-0x00000000021F7000-memory.dmp

Filesize
92KB

Download
memory/4832-6-0x0000000002220000-0x0000000002230000-memory.dmp

Filesize
64KB

Download
memory/4832-5-0x0000000002200000-0x0000000002217000-memory.dmp

Filesize
92KB

Download
memory/4832-14-0x00000000021E0000-0x00000000021F7000-memory.dmp

Filesize
92KB

Download
memory/4832-1-0x0000000002200000-0x0000000002217000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing