emotet | a1eb90a0620b24ee6759f9e946b722e2934d2c6e3ead23bd903273968d097d7a

General

Target

dc8f5e6885e1e4f5b53d2a3ef630f8e2_JaffaCakes118.exe
Size

108KB
MD5

dc8f5e6885e1e4f5b53d2a3ef630f8e2
SHA1

6513461ca4d89ed9c4bf2cda739c330a686fa44d
SHA256

a1eb90a0620b24ee6759f9e946b722e2934d2c6e3ead23bd903273968d097d7a
SHA512

5e9e4dcc766a876006a2d4fc9cc56520b4146001792ba3434dd90b32cb4f0890aa3acae76314888cfca910d2a2b8f509c92e0a6135808f6dff4e5dc921ad170d
SSDEEP

3072:ckwQXacEou7H7A5GQLcMSGikCJQ+nek6q:xwvcxkJEqU5+Zf

Score

10^/10

emotet banker discovery trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	sourceribbon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc8f5e6885e1e4f5b53d2a3ef630f8e2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc8f5e6885e1e4f5b53d2a3ef630f8e2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sourceribbon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sourceribbon.exe

Modifies data under HKEY_USERS 25 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{35A98CD5-8BA1-438B-83A6-58D762F74CF2}\WpadDecisionReason = "1"	sourceribbon.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4e-4d-5c-71-d0-9f\WpadDecisionTime = b08d40782c05db01	sourceribbon.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4e-4d-5c-71-d0-9f\WpadDecision = "0"	sourceribbon.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4e-4d-5c-71-d0-9f\WpadDecisionTime = 503772b12c05db01	sourceribbon.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	sourceribbon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	sourceribbon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	sourceribbon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	sourceribbon.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4e-4d-5c-71-d0-9f	sourceribbon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	sourceribbon.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{35A98CD5-8BA1-438B-83A6-58D762F74CF2}\WpadDecisionTime = 503772b12c05db01	sourceribbon.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f012d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	sourceribbon.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{35A98CD5-8BA1-438B-83A6-58D762F74CF2}\WpadDecisionTime = b08d40782c05db01	sourceribbon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	sourceribbon.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	sourceribbon.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	sourceribbon.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4e-4d-5c-71-d0-9f\WpadDecisionReason = "1"	sourceribbon.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	sourceribbon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	sourceribbon.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{35A98CD5-8BA1-438B-83A6-58D762F74CF2}\WpadDecision = "0"	sourceribbon.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{35A98CD5-8BA1-438B-83A6-58D762F74CF2}	sourceribbon.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{35A98CD5-8BA1-438B-83A6-58D762F74CF2}\4e-4d-5c-71-d0-9f	sourceribbon.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f012d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	sourceribbon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{35A98CD5-8BA1-438B-83A6-58D762F74CF2}\WpadNetworkName = "Network 3"	sourceribbon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4e-4d-5c-71-d0-9f\WpadDetectedUrl	sourceribbon.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2196	sourceribbon.exe
2196	sourceribbon.exe
2196	sourceribbon.exe
2196	sourceribbon.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1952	dc8f5e6885e1e4f5b53d2a3ef630f8e2_JaffaCakes118.exe

Suspicious use of UnmapMainImage 4 IoCs

pid	Process
2500	dc8f5e6885e1e4f5b53d2a3ef630f8e2_JaffaCakes118.exe
1952	dc8f5e6885e1e4f5b53d2a3ef630f8e2_JaffaCakes118.exe
292	sourceribbon.exe
2196	sourceribbon.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 1952	2500	dc8f5e6885e1e4f5b53d2a3ef630f8e2_JaffaCakes118.exe	30
PID 2500 wrote to memory of 1952	2500	dc8f5e6885e1e4f5b53d2a3ef630f8e2_JaffaCakes118.exe	30
PID 2500 wrote to memory of 1952	2500	dc8f5e6885e1e4f5b53d2a3ef630f8e2_JaffaCakes118.exe	30
PID 2500 wrote to memory of 1952	2500	dc8f5e6885e1e4f5b53d2a3ef630f8e2_JaffaCakes118.exe	30
PID 292 wrote to memory of 2196	292	sourceribbon.exe	33
PID 292 wrote to memory of 2196	292	sourceribbon.exe	33
PID 292 wrote to memory of 2196	292	sourceribbon.exe	33
PID 292 wrote to memory of 2196	292	sourceribbon.exe	33

C:\Users\Admin\AppData\Local\Temp\dc8f5e6885e1e4f5b53d2a3ef630f8e2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dc8f5e6885e1e4f5b53d2a3ef630f8e2_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Users\Admin\AppData\Local\Temp\dc8f5e6885e1e4f5b53d2a3ef630f8e2_JaffaCakes118.exe
  --7bf19263
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of UnmapMainImage
  PID:1952

C:\Windows\SysWOW64\sourceribbon.exe
"C:\Windows\SysWOW64\sourceribbon.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:292
- C:\Windows\SysWOW64\sourceribbon.exe
  --d2898c83
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/292-7-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1952-5-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1952-6-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1952-10-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2196-11-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2196-12-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2196-13-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2196-14-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2500-0-0x0000000000220000-0x0000000000231000-memory.dmp

Filesize
68KB

Download
memory/2500-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2500-4-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2500-3-0x0000000000220000-0x0000000000231000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing