emotet | 4e5a081de684a1b7dfc94683ee9a9514397b2889669b31480f3a15c122f74d4d

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 11:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe
Size

244KB
MD5

1b0bf8a16f6bec1b79b8355a35f040eb
SHA1

0bd77d6a9e9158d897c0b310c6e3225e69e65cdf
SHA256

4e5a081de684a1b7dfc94683ee9a9514397b2889669b31480f3a15c122f74d4d
SHA512

68b1b9b14599a2b8f812e4c80130edd586a013b3aa42386b85c37074395509d4787799c8550ad4a5547344c5ace4984c5c187a5be3d783e1c6deffd784f21aab
SSDEEP

3072:z6nl1RuGUvgeg55WRYrp3s9W3Heu65IZwC5:en7rUvTGBp3qW3Heij5

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

neutralbased.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	neutralbased.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	neutralbased.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	neutralbased.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	neutralbased.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

neutralbased.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	neutralbased.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	neutralbased.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	neutralbased.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exeneutralbased.exeneutralbased.exe

pid	process
4848	1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe
4848	1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe
936	1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe
936	1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe
3652	neutralbased.exe
3652	neutralbased.exe
1448	neutralbased.exe
1448	neutralbased.exe
1448	neutralbased.exe
1448	neutralbased.exe
1448	neutralbased.exe
1448	neutralbased.exe
1448	neutralbased.exe
1448	neutralbased.exe
1448	neutralbased.exe
1448	neutralbased.exe
1448	neutralbased.exe
1448	neutralbased.exe
1448	neutralbased.exe
1448	neutralbased.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe

pid process

936 1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe

pid	process
936	1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exeneutralbased.exe

description	pid	process	target process
PID 4848 wrote to memory of 936	4848	1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe	1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe
PID 4848 wrote to memory of 936	4848	1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe	1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe
PID 4848 wrote to memory of 936	4848	1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe	1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe
PID 3652 wrote to memory of 1448	3652	neutralbased.exe	neutralbased.exe
PID 3652 wrote to memory of 1448	3652	neutralbased.exe	neutralbased.exe
PID 3652 wrote to memory of 1448	3652	neutralbased.exe	neutralbased.exe

C:\Users\Admin\AppData\Local\Temp\1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4848

C:\Users\Admin\AppData\Local\Temp\1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b0bf8a16f6bec1b79b8355a35f040eb_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:936

C:\Windows\SysWOW64\neutralbased.exe
"C:\Windows\SysWOW64\neutralbased.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3652

C:\Windows\SysWOW64\neutralbased.exe
"C:\Windows\SysWOW64\neutralbased.exe"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1448

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/936-2-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/936-5-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/936-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1448-7-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1448-10-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1448-11-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3652-6-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4848-0-0x00000000004C0000-0x00000000004D2000-memory.dmp

Filesize
72KB

Download
memory/4848-1-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4848-4-0x00000000004C0000-0x00000000004D2000-memory.dmp

Filesize
72KB

Download