emotet | 7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082

General

Target

7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe
Size

416KB
MD5

d60db6762dce7f48762343f07e32dd5c
SHA1

b7b6bc97f8ddcefd7139115caf6a69da935a7ad5
SHA256

7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082
SHA512

4eb95489b280d610a0c3a6ae591e100fc5719fc93fb2f308b6f24779525fa8850479f8f00b7356f32db0ff03ad508443c68c242c2b2b4691409ebc10c648ce4e

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

tcgspecial.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	tcgspecial.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

tcgspecial.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	tcgspecial.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77	tcgspecial.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0"	tcgspecial.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionTime = 20ce623bc02bd701	tcgspecial.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	tcgspecial.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	tcgspecial.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	tcgspecial.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	tcgspecial.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	tcgspecial.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	tcgspecial.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07004a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	tcgspecial.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	tcgspecial.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}	tcgspecial.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecision = "0"	tcgspecial.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadNetworkName = "Network"	tcgspecial.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\32-e2-17-db-d2-77	tcgspecial.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1"	tcgspecial.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	tcgspecial.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	tcgspecial.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionReason = "1"	tcgspecial.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 20ce623bc02bd701	tcgspecial.exe

Suspicious behavior: EmotetMutantsSpam 2 IoCs

Processes:

7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exetcgspecial.exe

pid process

1816 7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe
1664 tcgspecial.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

tcgspecial.exe

pid process

1664 tcgspecial.exe
1664 tcgspecial.exe
1664 tcgspecial.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe

pid process

1816 7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe

pid	process
1816	7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe
1664	tcgspecial.exe

pid	process
1664	tcgspecial.exe
1664	tcgspecial.exe
1664	tcgspecial.exe

pid	process
1816	7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exetcgspecial.exetcgspecial.exe

pid	process
1272	7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe
1816	7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe
1496	tcgspecial.exe
1664	tcgspecial.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exetcgspecial.exe

description	pid	process	target process
PID 1272 wrote to memory of 1816	1272	7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe	7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe
PID 1272 wrote to memory of 1816	1272	7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe	7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe
PID 1272 wrote to memory of 1816	1272	7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe	7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe
PID 1272 wrote to memory of 1816	1272	7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe	7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe
PID 1496 wrote to memory of 1664	1496	tcgspecial.exe	tcgspecial.exe
PID 1496 wrote to memory of 1664	1496	tcgspecial.exe	tcgspecial.exe
PID 1496 wrote to memory of 1664	1496	tcgspecial.exe	tcgspecial.exe
PID 1496 wrote to memory of 1664	1496	tcgspecial.exe	tcgspecial.exe

C:\Users\Admin\AppData\Local\Temp\7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe
"C:\Users\Admin\AppData\Local\Temp\7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272

C:\Users\Admin\AppData\Local\Temp\7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe
--589ea4fa
2⤵
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1816

C:\Windows\SysWOW64\tcgspecial.exe
"C:\Windows\SysWOW64\tcgspecial.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\SysWOW64\tcgspecial.exe
--f054b5d3
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1664

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-2-0x0000000076881000-0x0000000076883000-memory.dmp

Filesize
8KB

Download
memory/1272-5-0x0000000000260000-0x0000000000271000-memory.dmp

Filesize
68KB

Download
memory/1664-9-0x0000000000000000-mapping.dmp

Download
memory/1664-12-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1816-3-0x0000000000000000-mapping.dmp

Download
memory/1816-6-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads