emotet | 7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082

General

Target

7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe
Size

416KB
MD5

d60db6762dce7f48762343f07e32dd5c
SHA1

b7b6bc97f8ddcefd7139115caf6a69da935a7ad5
SHA256

7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082
SHA512

4eb95489b280d610a0c3a6ae591e100fc5719fc93fb2f308b6f24779525fa8850479f8f00b7356f32db0ff03ad508443c68c242c2b2b4691409ebc10c648ce4e

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 5 IoCs

Processes:

fillmailbox.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	fillmailbox.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	fillmailbox.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	fillmailbox.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	fillmailbox.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	fillmailbox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

fillmailbox.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	fillmailbox.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	fillmailbox.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	fillmailbox.exe

Suspicious behavior: EmotetMutantsSpam 2 IoCs

Processes:

7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exefillmailbox.exe

pid process

3064 7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe
2360 fillmailbox.exe

pid	process
3064	7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe
2360	fillmailbox.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

fillmailbox.exe

pid	process
2360	fillmailbox.exe
2360	fillmailbox.exe
2360	fillmailbox.exe
2360	fillmailbox.exe
2360	fillmailbox.exe
2360	fillmailbox.exe
2360	fillmailbox.exe
2360	fillmailbox.exe
2360	fillmailbox.exe
2360	fillmailbox.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe

pid process

3064 7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe

pid	process
3064	7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exefillmailbox.exefillmailbox.exe

pid	process
508	7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe
3064	7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe
2492	fillmailbox.exe
2360	fillmailbox.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exefillmailbox.exe

description	pid	process	target process
PID 508 wrote to memory of 3064	508	7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe	7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe
PID 508 wrote to memory of 3064	508	7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe	7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe
PID 508 wrote to memory of 3064	508	7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe	7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe
PID 2492 wrote to memory of 2360	2492	fillmailbox.exe	fillmailbox.exe
PID 2492 wrote to memory of 2360	2492	fillmailbox.exe	fillmailbox.exe
PID 2492 wrote to memory of 2360	2492	fillmailbox.exe	fillmailbox.exe

C:\Users\Admin\AppData\Local\Temp\7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe
"C:\Users\Admin\AppData\Local\Temp\7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:508

C:\Users\Admin\AppData\Local\Temp\7262c08879b52c29ad74235c47825ac3be4878bf7a24b7bad61a356ea1749082.exe
--589ea4fa
2⤵
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:3064

C:\Windows\SysWOW64\fillmailbox.exe
"C:\Windows\SysWOW64\fillmailbox.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492

C:\Windows\SysWOW64\fillmailbox.exe
--571756e7
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2360

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\b36208c2e0ba1c7f0e7f094499ea3452_72727c5d-8d0e-47bb-8579-8067735277ff
MD5
d854e5bf32f6eff669679c3a9acd847a

SHA1
0d43be3bd4161a1cbb329c910fdf62346fa45b20

SHA256
5a08f974f0f6e267fb0a7658b1d80e809a3f4f1293a9149238b647f3ed305660

SHA512
2dafe095dadaf0536ab48043a05b71900717e49c6a344e3fcd4fa1282db0a46559e67528d541195efaafc77e53d2e69cbe6da46f4ce0fcf827f9d94c4bb48259

Download Submit
memory/508-3-0x0000000000560000-0x0000000000571000-memory.dmp

Filesize
68KB

Download
memory/2360-6-0x0000000000000000-mapping.dmp

Download
memory/2360-9-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3064-2-0x0000000000000000-mapping.dmp

Download
memory/3064-4-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads