emotet | dc9f1171bee4f5cac436903afb7520c3349bdafa3061c00bc3a1b30835294947

General

Target

e454d4f712f505553904b631ea5a9774_JaffaCakes118.exe
Size

492KB
MD5

e454d4f712f505553904b631ea5a9774
SHA1

e8ed4ebfd326266de209cf382073d16b53a4f4e6
SHA256

dc9f1171bee4f5cac436903afb7520c3349bdafa3061c00bc3a1b30835294947
SHA512

f14065267e1dce81c2c6ce79b44afa8b88ab7aa8a880528aa9b8e7a85f5e5d3bcaba9a289f571447f7d99361158e365a57bc6f4b56f34c520198d0c5ab585bf1
SSDEEP

1536:yDE3zjKIo0qg/E9V9JBUruE7mlCe5/SyWvJ5lstDeM5qWfZOYxWa6a1aVUPGgF8Z:yqnXo19JBUruEdvvhgDejWfZOrEYnZ

Score

10^/10

emotet banker discovery trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e454d4f712f505553904b631ea5a9774_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e454d4f712f505553904b631ea5a9774_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifacegraph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifacegraph.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2652	e454d4f712f505553904b631ea5a9774_JaffaCakes118.exe
2652	e454d4f712f505553904b631ea5a9774_JaffaCakes118.exe
2032	e454d4f712f505553904b631ea5a9774_JaffaCakes118.exe
2032	e454d4f712f505553904b631ea5a9774_JaffaCakes118.exe
4864	ifacegraph.exe
4864	ifacegraph.exe
4324	ifacegraph.exe
4324	ifacegraph.exe
4324	ifacegraph.exe
4324	ifacegraph.exe
4324	ifacegraph.exe
4324	ifacegraph.exe
4324	ifacegraph.exe
4324	ifacegraph.exe
4324	ifacegraph.exe
4324	ifacegraph.exe
4324	ifacegraph.exe
4324	ifacegraph.exe
4324	ifacegraph.exe
4324	ifacegraph.exe
4324	ifacegraph.exe
4324	ifacegraph.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2032	e454d4f712f505553904b631ea5a9774_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2032	2652	e454d4f712f505553904b631ea5a9774_JaffaCakes118.exe	82
PID 2652 wrote to memory of 2032	2652	e454d4f712f505553904b631ea5a9774_JaffaCakes118.exe	82
PID 2652 wrote to memory of 2032	2652	e454d4f712f505553904b631ea5a9774_JaffaCakes118.exe	82
PID 4864 wrote to memory of 4324	4864	ifacegraph.exe	84
PID 4864 wrote to memory of 4324	4864	ifacegraph.exe	84
PID 4864 wrote to memory of 4324	4864	ifacegraph.exe	84

C:\Users\Admin\AppData\Local\Temp\e454d4f712f505553904b631ea5a9774_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e454d4f712f505553904b631ea5a9774_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Users\Admin\AppData\Local\Temp\e454d4f712f505553904b631ea5a9774_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\e454d4f712f505553904b631ea5a9774_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  PID:2032

C:\Windows\SysWOW64\ifacegraph.exe
"C:\Windows\SysWOW64\ifacegraph.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\SysWOW64\ifacegraph.exe
  "C:\Windows\SysWOW64\ifacegraph.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-13-0x0000000000EB0000-0x0000000000EC0000-memory.dmp

Filesize
64KB

Download
memory/2032-29-0x0000000002940000-0x0000000002957000-memory.dmp

Filesize
92KB

Download
memory/2032-28-0x0000000000200000-0x000000000027D000-memory.dmp

Filesize
500KB

Download
memory/2032-12-0x0000000002960000-0x0000000002977000-memory.dmp

Filesize
92KB

Download
memory/2032-8-0x0000000002940000-0x0000000002957000-memory.dmp

Filesize
92KB

Download
memory/2032-7-0x0000000002960000-0x0000000002977000-memory.dmp

Filesize
92KB

Download
memory/2652-14-0x0000000000CF0000-0x0000000000D07000-memory.dmp

Filesize
92KB

Download
memory/2652-0-0x0000000000D10000-0x0000000000D27000-memory.dmp

Filesize
92KB

Download
memory/2652-5-0x0000000000D10000-0x0000000000D27000-memory.dmp

Filesize
92KB

Download
memory/2652-3-0x0000000000CF0000-0x0000000000D07000-memory.dmp

Filesize
92KB

Download
memory/2652-6-0x0000000000D30000-0x0000000000D40000-memory.dmp

Filesize
64KB

Download
memory/4324-26-0x0000000001250000-0x0000000001267000-memory.dmp

Filesize
92KB

Download
memory/4324-22-0x0000000001250000-0x0000000001267000-memory.dmp

Filesize
92KB

Download
memory/4864-15-0x0000000001250000-0x0000000001267000-memory.dmp

Filesize
92KB

Download
memory/4864-16-0x0000000001270000-0x0000000001287000-memory.dmp

Filesize
92KB

Download
memory/4864-20-0x0000000001270000-0x0000000001287000-memory.dmp

Filesize
92KB

Download
memory/4864-21-0x0000000001290000-0x00000000012A0000-memory.dmp

Filesize
64KB

Download
memory/4864-27-0x0000000001250000-0x0000000001267000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing