emotet | 04353446c29fd35b28ee9b67f8bd44979478501cca7c954753a79c52b68d9037

General

Target

04353446c29fd35b28ee9b67f8bd44979478501cca7c954753a79c52b68d9037.exe
Size

213KB
MD5

2653622242078de7e4a9d55e66cbcdc6
SHA1

7513efc0bbafb9cc0a7a0d93fdb82190616a97b1
SHA256

04353446c29fd35b28ee9b67f8bd44979478501cca7c954753a79c52b68d9037
SHA512

74ce7462caf2d509e0a87ae6dab1dd49dfbd33c448db78869e33500953a2cd80a9c9c0f9b8668c6e4b6323a15649462b0a459c063a14bc4c25c2b1e068a1b15c

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	msrasync.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	msrasync.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msrasync.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadNetworkName = "Network"	msrasync.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1"	msrasync.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadDecision = "0"	msrasync.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77	msrasync.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 00d07c37265ad601	msrasync.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0"	msrasync.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	msrasync.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}	msrasync.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadDecisionReason = "1"	msrasync.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadDecisionTime = 00d07c37265ad601	msrasync.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	msrasync.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msrasync.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	msrasync.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\32-e2-17-db-d2-77	msrasync.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	msrasync.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msrasync.exe

Suspicious behavior: EmotetMutantsSpam 2 IoCs

pid	Process
1276	04353446c29fd35b28ee9b67f8bd44979478501cca7c954753a79c52b68d9037.exe
1608	msrasync.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1124	04353446c29fd35b28ee9b67f8bd44979478501cca7c954753a79c52b68d9037.exe
1276	04353446c29fd35b28ee9b67f8bd44979478501cca7c954753a79c52b68d9037.exe
744	msrasync.exe
1608	msrasync.exe
1608	msrasync.exe
1608	msrasync.exe
1608	msrasync.exe
1608	msrasync.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1276	04353446c29fd35b28ee9b67f8bd44979478501cca7c954753a79c52b68d9037.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1276	1124	04353446c29fd35b28ee9b67f8bd44979478501cca7c954753a79c52b68d9037.exe	24
PID 1124 wrote to memory of 1276	1124	04353446c29fd35b28ee9b67f8bd44979478501cca7c954753a79c52b68d9037.exe	24
PID 1124 wrote to memory of 1276	1124	04353446c29fd35b28ee9b67f8bd44979478501cca7c954753a79c52b68d9037.exe	24
PID 1124 wrote to memory of 1276	1124	04353446c29fd35b28ee9b67f8bd44979478501cca7c954753a79c52b68d9037.exe	24
PID 744 wrote to memory of 1608	744	msrasync.exe	26
PID 744 wrote to memory of 1608	744	msrasync.exe	26
PID 744 wrote to memory of 1608	744	msrasync.exe	26
PID 744 wrote to memory of 1608	744	msrasync.exe	26

C:\Users\Admin\AppData\Local\Temp\04353446c29fd35b28ee9b67f8bd44979478501cca7c954753a79c52b68d9037.exe
"C:\Users\Admin\AppData\Local\Temp\04353446c29fd35b28ee9b67f8bd44979478501cca7c954753a79c52b68d9037.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Users\Admin\AppData\Local\Temp\04353446c29fd35b28ee9b67f8bd44979478501cca7c954753a79c52b68d9037.exe
  "C:\Users\Admin\AppData\Local\Temp\04353446c29fd35b28ee9b67f8bd44979478501cca7c954753a79c52b68d9037.exe"
  2⤵
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  PID:1276

C:\Windows\SysWOW64\msrasync.exe
"C:\Windows\SysWOW64\msrasync.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\SysWOW64\msrasync.exe
  "C:\Windows\SysWOW64\msrasync.exe"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: EnumeratesProcesses
  PID:1608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1124-0-0x0000000000260000-0x0000000000277000-memory.dmp

Filesize
92KB

Download
memory/1276-2-0x0000000000270000-0x0000000000287000-memory.dmp

Filesize
92KB

Download
memory/1276-3-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1608-6-0x00000000003E0000-0x00000000003F7000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing