emotet | e03853c9185e540db3630f384720384670ac3f7dbf7e4f460446b15128987e6f

General

Target

e03853c9185e540db3630f384720384670ac3f7dbf7e4f460446b15128987e6f.exe
Size

159KB
MD5

981a9180b41d94d131aa01b1ca7ed900
SHA1

0c29b41e390f651be99f03bac6074d44046e0284
SHA256

e03853c9185e540db3630f384720384670ac3f7dbf7e4f460446b15128987e6f
SHA512

e31a3ec4f69b5571455f35c91602c5a34435dc290eb4511842e7382c1981a1cf4b6bce61d06f1dc9dd6d21f52249a30739b554da4fe12773f7760e618cd8ec21

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

guiddefsitka.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	guiddefsitka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

guiddefsitka.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	guiddefsitka.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-bd-1b-12-0c-6a\WpadDecisionReason = "1"	guiddefsitka.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	guiddefsitka.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	guiddefsitka.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	guiddefsitka.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}	guiddefsitka.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecision = "0"	guiddefsitka.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	guiddefsitka.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	guiddefsitka.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadNetworkName = "Network"	guiddefsitka.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-bd-1b-12-0c-6a	guiddefsitka.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\0e-bd-1b-12-0c-6a	guiddefsitka.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	guiddefsitka.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionReason = "1"	guiddefsitka.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	guiddefsitka.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070013000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	guiddefsitka.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = 304c2654af4ad701	guiddefsitka.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-bd-1b-12-0c-6a\WpadDecisionTime = 304c2654af4ad701	guiddefsitka.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-bd-1b-12-0c-6a\WpadDecision = "0"	guiddefsitka.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	guiddefsitka.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	guiddefsitka.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

guiddefsitka.exe

pid process

768 guiddefsitka.exe
768 guiddefsitka.exe
768 guiddefsitka.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

e03853c9185e540db3630f384720384670ac3f7dbf7e4f460446b15128987e6f.exe

pid process

1752 e03853c9185e540db3630f384720384670ac3f7dbf7e4f460446b15128987e6f.exe

pid	process
768	guiddefsitka.exe
768	guiddefsitka.exe
768	guiddefsitka.exe

pid	process
1752	e03853c9185e540db3630f384720384670ac3f7dbf7e4f460446b15128987e6f.exe

Suspicious use of UnmapMainImage 4 IoCs

Processes:

e03853c9185e540db3630f384720384670ac3f7dbf7e4f460446b15128987e6f.exee03853c9185e540db3630f384720384670ac3f7dbf7e4f460446b15128987e6f.exeguiddefsitka.exeguiddefsitka.exe

pid	process
1672	e03853c9185e540db3630f384720384670ac3f7dbf7e4f460446b15128987e6f.exe
1752	e03853c9185e540db3630f384720384670ac3f7dbf7e4f460446b15128987e6f.exe
524	guiddefsitka.exe
768	guiddefsitka.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

e03853c9185e540db3630f384720384670ac3f7dbf7e4f460446b15128987e6f.exeguiddefsitka.exe

description	pid	process	target process
PID 1672 wrote to memory of 1752	1672	e03853c9185e540db3630f384720384670ac3f7dbf7e4f460446b15128987e6f.exe	e03853c9185e540db3630f384720384670ac3f7dbf7e4f460446b15128987e6f.exe
PID 1672 wrote to memory of 1752	1672	e03853c9185e540db3630f384720384670ac3f7dbf7e4f460446b15128987e6f.exe	e03853c9185e540db3630f384720384670ac3f7dbf7e4f460446b15128987e6f.exe
PID 1672 wrote to memory of 1752	1672	e03853c9185e540db3630f384720384670ac3f7dbf7e4f460446b15128987e6f.exe	e03853c9185e540db3630f384720384670ac3f7dbf7e4f460446b15128987e6f.exe
PID 1672 wrote to memory of 1752	1672	e03853c9185e540db3630f384720384670ac3f7dbf7e4f460446b15128987e6f.exe	e03853c9185e540db3630f384720384670ac3f7dbf7e4f460446b15128987e6f.exe
PID 524 wrote to memory of 768	524	guiddefsitka.exe	guiddefsitka.exe
PID 524 wrote to memory of 768	524	guiddefsitka.exe	guiddefsitka.exe
PID 524 wrote to memory of 768	524	guiddefsitka.exe	guiddefsitka.exe
PID 524 wrote to memory of 768	524	guiddefsitka.exe	guiddefsitka.exe

C:\Users\Admin\AppData\Local\Temp\e03853c9185e540db3630f384720384670ac3f7dbf7e4f460446b15128987e6f.exe
"C:\Users\Admin\AppData\Local\Temp\e03853c9185e540db3630f384720384670ac3f7dbf7e4f460446b15128987e6f.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1672

C:\Users\Admin\AppData\Local\Temp\e03853c9185e540db3630f384720384670ac3f7dbf7e4f460446b15128987e6f.exe
--2f289d18
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:1752

C:\Windows\SysWOW64\guiddefsitka.exe
"C:\Windows\SysWOW64\guiddefsitka.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:524

C:\Windows\SysWOW64\guiddefsitka.exe
--3ae91aaa
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:768

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/768-69-0x0000000000000000-mapping.dmp

Download
memory/768-72-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1672-59-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/1672-62-0x0000000000220000-0x0000000000231000-memory.dmp

Filesize
68KB

Download
memory/1672-63-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1752-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads