emotet | efd9f27dc06fe39568ed2123ce4ac69c696fa62eec9e5ce60f6e5b6f4a0eac7b

General

Target

e4e52cd9f6d6be97ee805def0c8644ed_JaffaCakes118.exe
Size

168KB
MD5

e4e52cd9f6d6be97ee805def0c8644ed
SHA1

1fbbd6d4decb102e15f8c3e545d06a2006e8ef08
SHA256

efd9f27dc06fe39568ed2123ce4ac69c696fa62eec9e5ce60f6e5b6f4a0eac7b
SHA512

de83b6dc3d7cd8e42ddfb3468e2803e5b75c17d03dc4c9d5c63210a74d5263a7875ceeffa7d8a2a80a9bb2e29fa6e868d9376f9ed2f8a00411dbe0a958cecb75
SSDEEP

3072:IWVPtoludJgQz2SDKTR/VS4k5/0lUWY86bIWLLNrme/1Z:XVleugGLZ4Kd

Score

10^/10

emotet banker discovery trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	wabindexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e4e52cd9f6d6be97ee805def0c8644ed_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e4e52cd9f6d6be97ee805def0c8644ed_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wabindexer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wabindexer.exe

Modifies data under HKEY_USERS 22 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{963AACC6-416A-4C4D-BAE3-65DCAA05AF64}\WpadDecision = "0"	wabindexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{963AACC6-416A-4C4D-BAE3-65DCAA05AF64}\WpadNetworkName = "Network 3"	wabindexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{963AACC6-416A-4C4D-BAE3-65DCAA05AF64}\76-df-b0-ec-81-1d	wabindexer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-df-b0-ec-81-1d\WpadDecisionReason = "1"	wabindexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-df-b0-ec-81-1d\WpadDecisionTime = b0b47e993e08db01	wabindexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	wabindexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{963AACC6-416A-4C4D-BAE3-65DCAA05AF64}	wabindexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00e2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wabindexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-df-b0-ec-81-1d	wabindexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-df-b0-ec-81-1d\WpadDecisionTime = 10c346633e08db01	wabindexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-df-b0-ec-81-1d\WpadDetectedUrl	wabindexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00e2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wabindexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	wabindexer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	wabindexer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-df-b0-ec-81-1d\WpadDecision = "0"	wabindexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wabindexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{963AACC6-416A-4C4D-BAE3-65DCAA05AF64}\WpadDecisionTime = 10c346633e08db01	wabindexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	wabindexer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{963AACC6-416A-4C4D-BAE3-65DCAA05AF64}\WpadDecisionReason = "1"	wabindexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{963AACC6-416A-4C4D-BAE3-65DCAA05AF64}\WpadDecisionTime = b0b47e993e08db01	wabindexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	wabindexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wabindexer.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1856	e4e52cd9f6d6be97ee805def0c8644ed_JaffaCakes118.exe
2576	e4e52cd9f6d6be97ee805def0c8644ed_JaffaCakes118.exe
2920	wabindexer.exe
2168	wabindexer.exe
2168	wabindexer.exe
2168	wabindexer.exe
2168	wabindexer.exe
2168	wabindexer.exe
2168	wabindexer.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2576	e4e52cd9f6d6be97ee805def0c8644ed_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2576	1856	e4e52cd9f6d6be97ee805def0c8644ed_JaffaCakes118.exe	30
PID 1856 wrote to memory of 2576	1856	e4e52cd9f6d6be97ee805def0c8644ed_JaffaCakes118.exe	30
PID 1856 wrote to memory of 2576	1856	e4e52cd9f6d6be97ee805def0c8644ed_JaffaCakes118.exe	30
PID 1856 wrote to memory of 2576	1856	e4e52cd9f6d6be97ee805def0c8644ed_JaffaCakes118.exe	30
PID 2920 wrote to memory of 2168	2920	wabindexer.exe	33
PID 2920 wrote to memory of 2168	2920	wabindexer.exe	33
PID 2920 wrote to memory of 2168	2920	wabindexer.exe	33
PID 2920 wrote to memory of 2168	2920	wabindexer.exe	33

C:\Users\Admin\AppData\Local\Temp\e4e52cd9f6d6be97ee805def0c8644ed_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e4e52cd9f6d6be97ee805def0c8644ed_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\e4e52cd9f6d6be97ee805def0c8644ed_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\e4e52cd9f6d6be97ee805def0c8644ed_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  PID:2576

C:\Windows\SysWOW64\wabindexer.exe
"C:\Windows\SysWOW64\wabindexer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\wabindexer.exe
  "C:\Windows\SysWOW64\wabindexer.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1856-4-0x00000000005E0000-0x00000000005FA000-memory.dmp

Filesize
104KB

Download
memory/1856-8-0x0000000002260000-0x000000000228B000-memory.dmp

Filesize
172KB

Download
memory/1856-7-0x00000000005C0000-0x00000000005DA000-memory.dmp

Filesize
104KB

Download
memory/1856-6-0x0000000000600000-0x0000000000620000-memory.dmp

Filesize
128KB

Download
memory/1856-0-0x00000000005E0000-0x00000000005FA000-memory.dmp

Filesize
104KB

Download
memory/1856-15-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1856-5-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2168-29-0x0000000000430000-0x000000000044A000-memory.dmp

Filesize
104KB

Download
memory/2168-35-0x00000000003D0000-0x00000000003EA000-memory.dmp

Filesize
104KB

Download
memory/2168-30-0x00000000003D0000-0x00000000003EA000-memory.dmp

Filesize
104KB

Download
memory/2168-31-0x0000000000450000-0x0000000000470000-memory.dmp

Filesize
128KB

Download
memory/2168-25-0x0000000000430000-0x000000000044A000-memory.dmp

Filesize
104KB

Download
memory/2576-10-0x00000000002A0000-0x00000000002BA000-memory.dmp

Filesize
104KB

Download
memory/2576-23-0x0000000000280000-0x000000000029A000-memory.dmp

Filesize
104KB

Download
memory/2576-14-0x00000000002A0000-0x00000000002BA000-memory.dmp

Filesize
104KB

Download
memory/2576-16-0x00000000002C0000-0x00000000002E0000-memory.dmp

Filesize
128KB

Download
memory/2576-34-0x0000000000280000-0x000000000029A000-memory.dmp

Filesize
104KB

Download
memory/2576-9-0x0000000000280000-0x000000000029A000-memory.dmp

Filesize
104KB

Download
memory/2920-22-0x00000000003E0000-0x00000000003FA000-memory.dmp

Filesize
104KB

Download
memory/2920-24-0x0000000000430000-0x0000000000450000-memory.dmp

Filesize
128KB

Download
memory/2920-18-0x00000000003E0000-0x00000000003FA000-memory.dmp

Filesize
104KB

Download
memory/2920-17-0x00000000003C0000-0x00000000003DA000-memory.dmp

Filesize
104KB

Download
memory/2920-32-0x00000000003C0000-0x00000000003DA000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing