emotet | 31b5725ee2bcf56a5d8fc973b1afda81af373131df9e4e56707b407f40b6fdb8

General

Target

31b5725ee2bcf56a5d8fc973b1afda81af373131df9e4e56707b407f40b6fdb8.exe
Size

135KB
MD5

47973b995f5eafc00c6dc1bf4ccbf22a
SHA1

05875466d47aa40ce0d2838640429c7a43e3cab8
SHA256

31b5725ee2bcf56a5d8fc973b1afda81af373131df9e4e56707b407f40b6fdb8
SHA512

6ae6aeb21446b7080249d50ca6f86361b184f9cb3b8d69c48ae7e2abf742cf329ac1093ef8b1dd4427fbde9eb1479abe48724cd46bc91cb54b8652a25b033947

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

repcomment.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	repcomment.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

repcomment.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070015000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	repcomment.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}	repcomment.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadNetworkName = "Network"	repcomment.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\32-e2-17-db-d2-77	repcomment.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 10c24411cb49d701	repcomment.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	repcomment.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	repcomment.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	repcomment.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	repcomment.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionTime = 10c24411cb49d701	repcomment.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77	repcomment.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1"	repcomment.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	repcomment.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	repcomment.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	repcomment.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	repcomment.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	repcomment.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	repcomment.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionReason = "1"	repcomment.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecision = "0"	repcomment.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0"	repcomment.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

repcomment.exe

pid process

1764 repcomment.exe
1764 repcomment.exe
1764 repcomment.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

31b5725ee2bcf56a5d8fc973b1afda81af373131df9e4e56707b407f40b6fdb8.exe

pid process

1740 31b5725ee2bcf56a5d8fc973b1afda81af373131df9e4e56707b407f40b6fdb8.exe

pid	process
1764	repcomment.exe
1764	repcomment.exe
1764	repcomment.exe

pid	process
1740	31b5725ee2bcf56a5d8fc973b1afda81af373131df9e4e56707b407f40b6fdb8.exe

Suspicious use of UnmapMainImage 4 IoCs

Processes:

31b5725ee2bcf56a5d8fc973b1afda81af373131df9e4e56707b407f40b6fdb8.exe31b5725ee2bcf56a5d8fc973b1afda81af373131df9e4e56707b407f40b6fdb8.exerepcomment.exerepcomment.exe

pid	process
1360	31b5725ee2bcf56a5d8fc973b1afda81af373131df9e4e56707b407f40b6fdb8.exe
1740	31b5725ee2bcf56a5d8fc973b1afda81af373131df9e4e56707b407f40b6fdb8.exe
784	repcomment.exe
1764	repcomment.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

31b5725ee2bcf56a5d8fc973b1afda81af373131df9e4e56707b407f40b6fdb8.exerepcomment.exe

description	pid	process	target process
PID 1360 wrote to memory of 1740	1360	31b5725ee2bcf56a5d8fc973b1afda81af373131df9e4e56707b407f40b6fdb8.exe	31b5725ee2bcf56a5d8fc973b1afda81af373131df9e4e56707b407f40b6fdb8.exe
PID 1360 wrote to memory of 1740	1360	31b5725ee2bcf56a5d8fc973b1afda81af373131df9e4e56707b407f40b6fdb8.exe	31b5725ee2bcf56a5d8fc973b1afda81af373131df9e4e56707b407f40b6fdb8.exe
PID 1360 wrote to memory of 1740	1360	31b5725ee2bcf56a5d8fc973b1afda81af373131df9e4e56707b407f40b6fdb8.exe	31b5725ee2bcf56a5d8fc973b1afda81af373131df9e4e56707b407f40b6fdb8.exe
PID 1360 wrote to memory of 1740	1360	31b5725ee2bcf56a5d8fc973b1afda81af373131df9e4e56707b407f40b6fdb8.exe	31b5725ee2bcf56a5d8fc973b1afda81af373131df9e4e56707b407f40b6fdb8.exe
PID 784 wrote to memory of 1764	784	repcomment.exe	repcomment.exe
PID 784 wrote to memory of 1764	784	repcomment.exe	repcomment.exe
PID 784 wrote to memory of 1764	784	repcomment.exe	repcomment.exe
PID 784 wrote to memory of 1764	784	repcomment.exe	repcomment.exe

C:\Users\Admin\AppData\Local\Temp\31b5725ee2bcf56a5d8fc973b1afda81af373131df9e4e56707b407f40b6fdb8.exe
"C:\Users\Admin\AppData\Local\Temp\31b5725ee2bcf56a5d8fc973b1afda81af373131df9e4e56707b407f40b6fdb8.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Users\Admin\AppData\Local\Temp\31b5725ee2bcf56a5d8fc973b1afda81af373131df9e4e56707b407f40b6fdb8.exe
  --1b6b0219
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of UnmapMainImage
  PID:1740

C:\Windows\SysWOW64\repcomment.exe
"C:\Windows\SysWOW64\repcomment.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\SysWOW64\repcomment.exe
  --ddf04774
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:1764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1360-59-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download
memory/1360-60-0x0000000000220000-0x0000000000231000-memory.dmp

Filesize
68KB

Download
memory/1360-63-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1740-61-0x0000000000000000-mapping.dmp

Download
memory/1764-68-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads