emotet | a1eb90a0620b24ee6759f9e946b722e2934d2c6e3ead23bd903273968d097d7a

General

Target

dc8f5e6885e1e4f5b53d2a3ef630f8e2_JaffaCakes118.exe
Size

108KB
MD5

dc8f5e6885e1e4f5b53d2a3ef630f8e2
SHA1

6513461ca4d89ed9c4bf2cda739c330a686fa44d
SHA256

a1eb90a0620b24ee6759f9e946b722e2934d2c6e3ead23bd903273968d097d7a
SHA512

5e9e4dcc766a876006a2d4fc9cc56520b4146001792ba3434dd90b32cb4f0890aa3acae76314888cfca910d2a2b8f509c92e0a6135808f6dff4e5dc921ad170d
SSDEEP

3072:ckwQXacEou7H7A5GQLcMSGikCJQ+nek6q:xwvcxkJEqU5+Zf

Score

10^/10

emotet banker discovery trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	adjustcloud.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	adjustcloud.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	adjustcloud.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	adjustcloud.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc8f5e6885e1e4f5b53d2a3ef630f8e2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc8f5e6885e1e4f5b53d2a3ef630f8e2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adjustcloud.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adjustcloud.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	adjustcloud.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	adjustcloud.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	adjustcloud.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2312	adjustcloud.exe
2312	adjustcloud.exe
2312	adjustcloud.exe
2312	adjustcloud.exe
2312	adjustcloud.exe
2312	adjustcloud.exe
2312	adjustcloud.exe
2312	adjustcloud.exe
2312	adjustcloud.exe
2312	adjustcloud.exe
2312	adjustcloud.exe
2312	adjustcloud.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1448	dc8f5e6885e1e4f5b53d2a3ef630f8e2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 1448	3488	dc8f5e6885e1e4f5b53d2a3ef630f8e2_JaffaCakes118.exe	86
PID 3488 wrote to memory of 1448	3488	dc8f5e6885e1e4f5b53d2a3ef630f8e2_JaffaCakes118.exe	86
PID 3488 wrote to memory of 1448	3488	dc8f5e6885e1e4f5b53d2a3ef630f8e2_JaffaCakes118.exe	86
PID 4692 wrote to memory of 2312	4692	adjustcloud.exe	93
PID 4692 wrote to memory of 2312	4692	adjustcloud.exe	93
PID 4692 wrote to memory of 2312	4692	adjustcloud.exe	93

C:\Users\Admin\AppData\Local\Temp\dc8f5e6885e1e4f5b53d2a3ef630f8e2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dc8f5e6885e1e4f5b53d2a3ef630f8e2_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Users\Admin\AppData\Local\Temp\dc8f5e6885e1e4f5b53d2a3ef630f8e2_JaffaCakes118.exe
  --7bf19263
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  PID:1448

C:\Windows\SysWOW64\adjustcloud.exe
"C:\Windows\SysWOW64\adjustcloud.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\SysWOW64\adjustcloud.exe
  --18c3f67c
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1448-13-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1448-5-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1448-6-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2312-18-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2312-16-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2312-15-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2312-14-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3488-4-0x00000000004F0000-0x0000000000501000-memory.dmp

Filesize
68KB

Download
memory/3488-0-0x00000000004F0000-0x0000000000501000-memory.dmp

Filesize
68KB

Download
memory/3488-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3488-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4692-8-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4692-7-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing