emotet | 2863a051a679a1a1880d4270c27dc5a01cc475be59545ad69efb99ad6fa1cf5c

General

Target

eca9239739dced27d1ddc9e1dc98a252_JaffaCakes118.exe
Size

152KB
MD5

eca9239739dced27d1ddc9e1dc98a252
SHA1

0c1b759045839ac8f768e04f2c90ec9fd7f2196c
SHA256

2863a051a679a1a1880d4270c27dc5a01cc475be59545ad69efb99ad6fa1cf5c
SHA512

4283793fbf86f5ece86e3350e7072e90fc1a292a2ef272b0e3c24b8ec47b65fcfdad8fa89069ac0389990a0d6b40fe20b8095ea4f9ba7fd4247f916f962d4f51
SSDEEP

1536:867Ojy88OcfgkOpeKtbSyVwr/Jpsi/RA3ffm15FK/HO5Se8MNf0A1E6im1O8P5lf:8xyrf3SbSyODJpx/Ro3mls0Trx0O3f

Score

10^/10

emotet banker discovery trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	sendandrestore.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eca9239739dced27d1ddc9e1dc98a252_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eca9239739dced27d1ddc9e1dc98a252_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sendandrestore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sendandrestore.exe

Modifies data under HKEY_USERS 22 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-0a-44-cf-d0-4e\WpadDecision = "0"	sendandrestore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-0a-44-cf-d0-4e\WpadDetectedUrl	sendandrestore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-0a-44-cf-d0-4e\WpadDecisionTime = 702fcdd8040bdb01	sendandrestore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	sendandrestore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0073000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	sendandrestore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{01EEB02F-39B1-42CF-ADE7-FFACDEC9ABF7}\92-0a-44-cf-d0-4e	sendandrestore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{01EEB02F-39B1-42CF-ADE7-FFACDEC9ABF7}\WpadDecisionReason = "1"	sendandrestore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{01EEB02F-39B1-42CF-ADE7-FFACDEC9ABF7}\WpadDecisionTime = 90f0fc8b040bdb01	sendandrestore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-0a-44-cf-d0-4e\WpadDecisionReason = "1"	sendandrestore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-0a-44-cf-d0-4e\WpadDecisionTime = 90f0fc8b040bdb01	sendandrestore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	sendandrestore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	sendandrestore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	sendandrestore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{01EEB02F-39B1-42CF-ADE7-FFACDEC9ABF7}\WpadDecision = "0"	sendandrestore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{01EEB02F-39B1-42CF-ADE7-FFACDEC9ABF7}	sendandrestore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{01EEB02F-39B1-42CF-ADE7-FFACDEC9ABF7}\WpadNetworkName = "Network 3"	sendandrestore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-0a-44-cf-d0-4e	sendandrestore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0073000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	sendandrestore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{01EEB02F-39B1-42CF-ADE7-FFACDEC9ABF7}\WpadDecisionTime = 702fcdd8040bdb01	sendandrestore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	sendandrestore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	sendandrestore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	sendandrestore.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2716	eca9239739dced27d1ddc9e1dc98a252_JaffaCakes118.exe
2176	eca9239739dced27d1ddc9e1dc98a252_JaffaCakes118.exe
2692	sendandrestore.exe
2896	sendandrestore.exe
2896	sendandrestore.exe
2896	sendandrestore.exe
2896	sendandrestore.exe
2896	sendandrestore.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2176	eca9239739dced27d1ddc9e1dc98a252_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2176	2716	eca9239739dced27d1ddc9e1dc98a252_JaffaCakes118.exe	31
PID 2716 wrote to memory of 2176	2716	eca9239739dced27d1ddc9e1dc98a252_JaffaCakes118.exe	31
PID 2716 wrote to memory of 2176	2716	eca9239739dced27d1ddc9e1dc98a252_JaffaCakes118.exe	31
PID 2716 wrote to memory of 2176	2716	eca9239739dced27d1ddc9e1dc98a252_JaffaCakes118.exe	31
PID 2692 wrote to memory of 2896	2692	sendandrestore.exe	33
PID 2692 wrote to memory of 2896	2692	sendandrestore.exe	33
PID 2692 wrote to memory of 2896	2692	sendandrestore.exe	33
PID 2692 wrote to memory of 2896	2692	sendandrestore.exe	33

C:\Users\Admin\AppData\Local\Temp\eca9239739dced27d1ddc9e1dc98a252_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eca9239739dced27d1ddc9e1dc98a252_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Users\Admin\AppData\Local\Temp\eca9239739dced27d1ddc9e1dc98a252_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\eca9239739dced27d1ddc9e1dc98a252_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  PID:2176

C:\Windows\SysWOW64\sendandrestore.exe
"C:\Windows\SysWOW64\sendandrestore.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\sendandrestore.exe
  "C:\Windows\SysWOW64\sendandrestore.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2176-13-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2176-29-0x00000000002D0000-0x00000000002E7000-memory.dmp

Filesize
92KB

Download
memory/2176-28-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2176-21-0x00000000002D0000-0x00000000002E7000-memory.dmp

Filesize
92KB

Download
memory/2176-7-0x00000000002D0000-0x00000000002E7000-memory.dmp

Filesize
92KB

Download
memory/2176-8-0x00000000002F0000-0x0000000000307000-memory.dmp

Filesize
92KB

Download
memory/2176-12-0x00000000002F0000-0x0000000000307000-memory.dmp

Filesize
92KB

Download
memory/2692-18-0x0000000000330000-0x0000000000347000-memory.dmp

Filesize
92KB

Download
memory/2692-14-0x0000000000330000-0x0000000000347000-memory.dmp

Filesize
92KB

Download
memory/2692-20-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2692-19-0x0000000000310000-0x0000000000327000-memory.dmp

Filesize
92KB

Download
memory/2716-4-0x00000000003E0000-0x00000000003F7000-memory.dmp

Filesize
92KB

Download
memory/2716-6-0x0000000000430000-0x0000000000440000-memory.dmp

Filesize
64KB

Download
memory/2716-5-0x0000000000250000-0x0000000000267000-memory.dmp

Filesize
92KB

Download
memory/2716-0-0x00000000003E0000-0x00000000003F7000-memory.dmp

Filesize
92KB

Download
memory/2896-27-0x0000000000250000-0x0000000000267000-memory.dmp

Filesize
92KB

Download
memory/2896-30-0x0000000000250000-0x0000000000267000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing