emotet | 675bfe119daa42f8c92dcacee797128117a63f91dd1d0793d0ab0cc35de25a6b

General

Target

675bfe119daa42f8c92dcacee797128117a63f91dd1d0793d0ab0cc35de25a6b.exe
Size

404KB
MD5

e4fb62d297655a172fea821a2b9df01f
SHA1

62ed27f2423b852c525a72cd3cf85434f948c94d
SHA256

675bfe119daa42f8c92dcacee797128117a63f91dd1d0793d0ab0cc35de25a6b
SHA512

7763dc10326dade3c915dc075845496eb5edc9d573b1145c49053caf8798f4f263ad6bf08135b8e0dbfa20897c466171dd02c7e8936381408d88e6d7c8ee118a

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

ipmitcg.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	ipmitcg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

ipmitcg.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ipmitcg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	ipmitcg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	ipmitcg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	ipmitcg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1"	ipmitcg.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77	ipmitcg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0"	ipmitcg.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ipmitcg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	ipmitcg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ipmitcg.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ipmitcg.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070051000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ipmitcg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecision = "0"	ipmitcg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	ipmitcg.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}	ipmitcg.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionTime = 90822831c22bd701	ipmitcg.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 90822831c22bd701	ipmitcg.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	ipmitcg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionReason = "1"	ipmitcg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadNetworkName = "Network"	ipmitcg.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\32-e2-17-db-d2-77	ipmitcg.exe

Suspicious behavior: EmotetMutantsSpam 2 IoCs

Processes:

675bfe119daa42f8c92dcacee797128117a63f91dd1d0793d0ab0cc35de25a6b.exeipmitcg.exe

pid process

1684 675bfe119daa42f8c92dcacee797128117a63f91dd1d0793d0ab0cc35de25a6b.exe
1892 ipmitcg.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

ipmitcg.exe

pid process

1892 ipmitcg.exe
1892 ipmitcg.exe
1892 ipmitcg.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

675bfe119daa42f8c92dcacee797128117a63f91dd1d0793d0ab0cc35de25a6b.exe

pid process

1684 675bfe119daa42f8c92dcacee797128117a63f91dd1d0793d0ab0cc35de25a6b.exe

pid	process
1684	675bfe119daa42f8c92dcacee797128117a63f91dd1d0793d0ab0cc35de25a6b.exe
1892	ipmitcg.exe

pid	process
1892	ipmitcg.exe
1892	ipmitcg.exe
1892	ipmitcg.exe

pid	process
1684	675bfe119daa42f8c92dcacee797128117a63f91dd1d0793d0ab0cc35de25a6b.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

675bfe119daa42f8c92dcacee797128117a63f91dd1d0793d0ab0cc35de25a6b.exe675bfe119daa42f8c92dcacee797128117a63f91dd1d0793d0ab0cc35de25a6b.exeipmitcg.exeipmitcg.exe

pid	process
2028	675bfe119daa42f8c92dcacee797128117a63f91dd1d0793d0ab0cc35de25a6b.exe
1684	675bfe119daa42f8c92dcacee797128117a63f91dd1d0793d0ab0cc35de25a6b.exe
1612	ipmitcg.exe
1892	ipmitcg.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

675bfe119daa42f8c92dcacee797128117a63f91dd1d0793d0ab0cc35de25a6b.exeipmitcg.exe

description	pid	process	target process
PID 2028 wrote to memory of 1684	2028	675bfe119daa42f8c92dcacee797128117a63f91dd1d0793d0ab0cc35de25a6b.exe	675bfe119daa42f8c92dcacee797128117a63f91dd1d0793d0ab0cc35de25a6b.exe
PID 2028 wrote to memory of 1684	2028	675bfe119daa42f8c92dcacee797128117a63f91dd1d0793d0ab0cc35de25a6b.exe	675bfe119daa42f8c92dcacee797128117a63f91dd1d0793d0ab0cc35de25a6b.exe
PID 2028 wrote to memory of 1684	2028	675bfe119daa42f8c92dcacee797128117a63f91dd1d0793d0ab0cc35de25a6b.exe	675bfe119daa42f8c92dcacee797128117a63f91dd1d0793d0ab0cc35de25a6b.exe
PID 2028 wrote to memory of 1684	2028	675bfe119daa42f8c92dcacee797128117a63f91dd1d0793d0ab0cc35de25a6b.exe	675bfe119daa42f8c92dcacee797128117a63f91dd1d0793d0ab0cc35de25a6b.exe
PID 1612 wrote to memory of 1892	1612	ipmitcg.exe	ipmitcg.exe
PID 1612 wrote to memory of 1892	1612	ipmitcg.exe	ipmitcg.exe
PID 1612 wrote to memory of 1892	1612	ipmitcg.exe	ipmitcg.exe
PID 1612 wrote to memory of 1892	1612	ipmitcg.exe	ipmitcg.exe

C:\Users\Admin\AppData\Local\Temp\675bfe119daa42f8c92dcacee797128117a63f91dd1d0793d0ab0cc35de25a6b.exe
"C:\Users\Admin\AppData\Local\Temp\675bfe119daa42f8c92dcacee797128117a63f91dd1d0793d0ab0cc35de25a6b.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028

C:\Users\Admin\AppData\Local\Temp\675bfe119daa42f8c92dcacee797128117a63f91dd1d0793d0ab0cc35de25a6b.exe
--b10e2adc
2⤵
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1684

C:\Windows\SysWOW64\ipmitcg.exe
"C:\Windows\SysWOW64\ipmitcg.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\SysWOW64\ipmitcg.exe
--7d4fc92b
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1892

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-3-0x0000000000000000-mapping.dmp

Download
memory/1684-6-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1892-9-0x0000000000000000-mapping.dmp

Download
memory/1892-11-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2028-2-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download
memory/2028-5-0x00000000001D0000-0x00000000001E1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads