emotet | 17be2b8b04f05fc00177b3f239ff7766cf36576c2102067adada7bdcb2146e8b

Analysis

max time kernel
130s
max time network
140s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b046fa80ee82864c1b2f07758be925f_JaffaCakes118.exe
Size

420KB
MD5

1b046fa80ee82864c1b2f07758be925f
SHA1

148bcd165406cd984dd3f4ea85de73c09d6fc24d
SHA256

17be2b8b04f05fc00177b3f239ff7766cf36576c2102067adada7bdcb2146e8b
SHA512

58b0440fa31962479939bbb5bb893db6ebc46890dd32f6bda32c5d335cfbadf3031081c3aa86fbd21b74353cc6d06006862a5d19b1b7241b2691ee1a4407c41d
SSDEEP

3072:P6j+WEvtjh69I9PcNfwzy0CNdhIoAuTUd2EUk8:hWEvj6W6fwjQfpz02

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Drops file in System32 directory 1 IoCs

Processes:

atalkpwd.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat atalkpwd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	atalkpwd.exe

Modifies data under HKEY_USERS 18 IoCs

Processes:

atalkpwd.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	atalkpwd.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	atalkpwd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	atalkpwd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F8B593D4-AC9C-4869-B34E-CD72B9B36F58}\WpadDecision = "0"	atalkpwd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	atalkpwd.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-1f-df-43-f7-d9	atalkpwd.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-1f-df-43-f7-d9\WpadDecisionTime = 9089fd04a5cbda01	atalkpwd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-1f-df-43-f7-d9\WpadDecision = "0"	atalkpwd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	atalkpwd.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0049000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	atalkpwd.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F8B593D4-AC9C-4869-B34E-CD72B9B36F58}	atalkpwd.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F8B593D4-AC9C-4869-B34E-CD72B9B36F58}\WpadDecisionTime = 9089fd04a5cbda01	atalkpwd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-1f-df-43-f7-d9\WpadDecisionReason = "1"	atalkpwd.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	atalkpwd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	atalkpwd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F8B593D4-AC9C-4869-B34E-CD72B9B36F58}\WpadDecisionReason = "1"	atalkpwd.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F8B593D4-AC9C-4869-B34E-CD72B9B36F58}\WpadNetworkName = "Network 3"	atalkpwd.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F8B593D4-AC9C-4869-B34E-CD72B9B36F58}\aa-1f-df-43-f7-d9	atalkpwd.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

1b046fa80ee82864c1b2f07758be925f_JaffaCakes118.exe1b046fa80ee82864c1b2f07758be925f_JaffaCakes118.exeatalkpwd.exeatalkpwd.exe

pid process

2356 1b046fa80ee82864c1b2f07758be925f_JaffaCakes118.exe
1076 1b046fa80ee82864c1b2f07758be925f_JaffaCakes118.exe
1420 atalkpwd.exe
2544 atalkpwd.exe
2544 atalkpwd.exe
2544 atalkpwd.exe
2544 atalkpwd.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

1b046fa80ee82864c1b2f07758be925f_JaffaCakes118.exe

pid process

1076 1b046fa80ee82864c1b2f07758be925f_JaffaCakes118.exe

pid	process
2356	1b046fa80ee82864c1b2f07758be925f_JaffaCakes118.exe
1076	1b046fa80ee82864c1b2f07758be925f_JaffaCakes118.exe
1420	atalkpwd.exe
2544	atalkpwd.exe
2544	atalkpwd.exe
2544	atalkpwd.exe
2544	atalkpwd.exe

pid	process
1076	1b046fa80ee82864c1b2f07758be925f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

1b046fa80ee82864c1b2f07758be925f_JaffaCakes118.exeatalkpwd.exe

description	pid	process	target process
PID 2356 wrote to memory of 1076	2356	1b046fa80ee82864c1b2f07758be925f_JaffaCakes118.exe	1b046fa80ee82864c1b2f07758be925f_JaffaCakes118.exe
PID 2356 wrote to memory of 1076	2356	1b046fa80ee82864c1b2f07758be925f_JaffaCakes118.exe	1b046fa80ee82864c1b2f07758be925f_JaffaCakes118.exe
PID 2356 wrote to memory of 1076	2356	1b046fa80ee82864c1b2f07758be925f_JaffaCakes118.exe	1b046fa80ee82864c1b2f07758be925f_JaffaCakes118.exe
PID 2356 wrote to memory of 1076	2356	1b046fa80ee82864c1b2f07758be925f_JaffaCakes118.exe	1b046fa80ee82864c1b2f07758be925f_JaffaCakes118.exe
PID 1420 wrote to memory of 2544	1420	atalkpwd.exe	atalkpwd.exe
PID 1420 wrote to memory of 2544	1420	atalkpwd.exe	atalkpwd.exe
PID 1420 wrote to memory of 2544	1420	atalkpwd.exe	atalkpwd.exe
PID 1420 wrote to memory of 2544	1420	atalkpwd.exe	atalkpwd.exe

C:\Users\Admin\AppData\Local\Temp\1b046fa80ee82864c1b2f07758be925f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b046fa80ee82864c1b2f07758be925f_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2356

C:\Users\Admin\AppData\Local\Temp\1b046fa80ee82864c1b2f07758be925f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b046fa80ee82864c1b2f07758be925f_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:1076

C:\Windows\SysWOW64\atalkpwd.exe
"C:\Windows\SysWOW64\atalkpwd.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\SysWOW64\atalkpwd.exe
"C:\Windows\SysWOW64\atalkpwd.exe"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2544

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1076-5-0x00000000000B0000-0x00000000000C9000-memory.dmp

Filesize
100KB

Download
memory/1076-28-0x0000000000FC0000-0x000000000102E000-memory.dmp

Filesize
440KB

Download
memory/1076-13-0x0000000000110000-0x0000000000120000-memory.dmp

Filesize
64KB

Download
memory/1076-12-0x0000000000090000-0x00000000000A9000-memory.dmp

Filesize
100KB

Download
memory/1076-29-0x0000000000090000-0x00000000000A9000-memory.dmp

Filesize
100KB

Download
memory/1076-9-0x00000000000B0000-0x00000000000C9000-memory.dmp

Filesize
100KB

Download
memory/1420-19-0x00000000003B0000-0x00000000003C9000-memory.dmp

Filesize
100KB

Download
memory/1420-20-0x00000000001E0000-0x00000000001F0000-memory.dmp

Filesize
64KB

Download
memory/1420-14-0x0000000000390000-0x00000000003A9000-memory.dmp

Filesize
100KB

Download
memory/1420-15-0x00000000003B0000-0x00000000003C9000-memory.dmp

Filesize
100KB

Download
memory/1420-27-0x0000000000390000-0x00000000003A9000-memory.dmp

Filesize
100KB

Download
memory/2356-11-0x0000000000200000-0x0000000000210000-memory.dmp

Filesize
64KB

Download
memory/2356-4-0x0000000000130000-0x0000000000149000-memory.dmp

Filesize
100KB

Download
memory/2356-0-0x0000000000130000-0x0000000000149000-memory.dmp

Filesize
100KB

Download
memory/2356-10-0x0000000000090000-0x00000000000A9000-memory.dmp

Filesize
100KB

Download
memory/2544-21-0x0000000000090000-0x00000000000A9000-memory.dmp

Filesize
100KB

Download
memory/2544-22-0x0000000000160000-0x0000000000179000-memory.dmp

Filesize
100KB

Download
memory/2544-26-0x0000000000160000-0x0000000000179000-memory.dmp

Filesize
100KB

Download
memory/2544-30-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/2544-31-0x0000000000090000-0x00000000000A9000-memory.dmp

Filesize
100KB

Download