emotet | fcbb4f917b7e4c714cc5e5b1e6f00dfd73004e6cfff915a9d18c9106af2138c6

General

Target

fcbb4f917b7e4c714cc5e5b1e6f00dfd73004e6cfff915a9d18c9106af2138c6.exe
Size

134KB
MD5

cbf44bba71f9952f4dccf83666369685
SHA1

b34f340dd2cfcb2ad5f5bb33ba3c5ee8a5bc3191
SHA256

fcbb4f917b7e4c714cc5e5b1e6f00dfd73004e6cfff915a9d18c9106af2138c6
SHA512

32e5baf68bd635c8a9b550a28055d8460a1d5a800ee748c94d0823df6455d092b64dfaf1ca8656648fee2ee7589c4f0acfdcdc49fba0af8fb2bce7b541d95780

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

flowslide.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	flowslide.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

flowslide.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	flowslide.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionReason = "1"	flowslide.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionTime = e0d2d3faa047d701	flowslide.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1"	flowslide.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	flowslide.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	flowslide.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}	flowslide.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecision = "0"	flowslide.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = e0d2d3faa047d701	flowslide.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	flowslide.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	flowslide.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	flowslide.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadNetworkName = "Network"	flowslide.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77	flowslide.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\32-e2-17-db-d2-77	flowslide.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	flowslide.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	flowslide.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	flowslide.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	flowslide.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070022000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	flowslide.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0"	flowslide.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

flowslide.exe

pid process

1912 flowslide.exe
1912 flowslide.exe
1912 flowslide.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

fcbb4f917b7e4c714cc5e5b1e6f00dfd73004e6cfff915a9d18c9106af2138c6.exe

pid process

792 fcbb4f917b7e4c714cc5e5b1e6f00dfd73004e6cfff915a9d18c9106af2138c6.exe

pid	process
1912	flowslide.exe
1912	flowslide.exe
1912	flowslide.exe

pid	process
792	fcbb4f917b7e4c714cc5e5b1e6f00dfd73004e6cfff915a9d18c9106af2138c6.exe

Suspicious use of UnmapMainImage 4 IoCs

Processes:

fcbb4f917b7e4c714cc5e5b1e6f00dfd73004e6cfff915a9d18c9106af2138c6.exefcbb4f917b7e4c714cc5e5b1e6f00dfd73004e6cfff915a9d18c9106af2138c6.exeflowslide.exeflowslide.exe

pid	process
2020	fcbb4f917b7e4c714cc5e5b1e6f00dfd73004e6cfff915a9d18c9106af2138c6.exe
792	fcbb4f917b7e4c714cc5e5b1e6f00dfd73004e6cfff915a9d18c9106af2138c6.exe
1080	flowslide.exe
1912	flowslide.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

fcbb4f917b7e4c714cc5e5b1e6f00dfd73004e6cfff915a9d18c9106af2138c6.exeflowslide.exe

description	pid	process	target process
PID 2020 wrote to memory of 792	2020	fcbb4f917b7e4c714cc5e5b1e6f00dfd73004e6cfff915a9d18c9106af2138c6.exe	fcbb4f917b7e4c714cc5e5b1e6f00dfd73004e6cfff915a9d18c9106af2138c6.exe
PID 2020 wrote to memory of 792	2020	fcbb4f917b7e4c714cc5e5b1e6f00dfd73004e6cfff915a9d18c9106af2138c6.exe	fcbb4f917b7e4c714cc5e5b1e6f00dfd73004e6cfff915a9d18c9106af2138c6.exe
PID 2020 wrote to memory of 792	2020	fcbb4f917b7e4c714cc5e5b1e6f00dfd73004e6cfff915a9d18c9106af2138c6.exe	fcbb4f917b7e4c714cc5e5b1e6f00dfd73004e6cfff915a9d18c9106af2138c6.exe
PID 2020 wrote to memory of 792	2020	fcbb4f917b7e4c714cc5e5b1e6f00dfd73004e6cfff915a9d18c9106af2138c6.exe	fcbb4f917b7e4c714cc5e5b1e6f00dfd73004e6cfff915a9d18c9106af2138c6.exe
PID 1080 wrote to memory of 1912	1080	flowslide.exe	flowslide.exe
PID 1080 wrote to memory of 1912	1080	flowslide.exe	flowslide.exe
PID 1080 wrote to memory of 1912	1080	flowslide.exe	flowslide.exe
PID 1080 wrote to memory of 1912	1080	flowslide.exe	flowslide.exe

C:\Users\Admin\AppData\Local\Temp\fcbb4f917b7e4c714cc5e5b1e6f00dfd73004e6cfff915a9d18c9106af2138c6.exe
"C:\Users\Admin\AppData\Local\Temp\fcbb4f917b7e4c714cc5e5b1e6f00dfd73004e6cfff915a9d18c9106af2138c6.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2020

C:\Users\Admin\AppData\Local\Temp\fcbb4f917b7e4c714cc5e5b1e6f00dfd73004e6cfff915a9d18c9106af2138c6.exe
--fb1e7135
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:792

C:\Windows\SysWOW64\flowslide.exe
"C:\Windows\SysWOW64\flowslide.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\SysWOW64\flowslide.exe
--8ac924d9
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/792-61-0x0000000000000000-mapping.dmp

Download
memory/1912-68-0x0000000000000000-mapping.dmp

Download
memory/2020-59-0x0000000076281000-0x0000000076283000-memory.dmp

Filesize
8KB

Download
memory/2020-60-0x0000000000220000-0x0000000000231000-memory.dmp

Filesize
68KB

Download
memory/2020-63-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads