emotet | 738563252e06801fa79207d33f6d431f16c341f8519d1b850130628f7b80d974

General

Target

738563252e06801fa79207d33f6d431f16c341f8519d1b850130628f7b80d974.exe
Size

134KB
MD5

e1aa4aaca213cc1167b082bd941633f6
SHA1

26dca8f5f820967d4d12fea51cf6c29e82b423fe
SHA256

738563252e06801fa79207d33f6d431f16c341f8519d1b850130628f7b80d974
SHA512

929ef2da34d2a8a910830437ad16b58452ba7532934e51317f1f0ba0147de3a5200ecc3b063b92821c66f41a4b755c8a687072b305219d16694c1921c430f8c9

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

xianxian.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	xianxian.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

xianxian.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionTime = 30a8136ca34ad701	xianxian.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77	xianxian.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	xianxian.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	xianxian.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	xianxian.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	xianxian.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionReason = "1"	xianxian.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	xianxian.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	xianxian.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	xianxian.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1"	xianxian.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0"	xianxian.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	xianxian.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	xianxian.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	xianxian.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}	xianxian.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\32-e2-17-db-d2-77	xianxian.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	xianxian.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecision = "0"	xianxian.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadNetworkName = "Network"	xianxian.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 30a8136ca34ad701	xianxian.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

xianxian.exe

pid process

1292 xianxian.exe
1292 xianxian.exe
1292 xianxian.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

738563252e06801fa79207d33f6d431f16c341f8519d1b850130628f7b80d974.exe

pid process

1760 738563252e06801fa79207d33f6d431f16c341f8519d1b850130628f7b80d974.exe

pid	process
1292	xianxian.exe
1292	xianxian.exe
1292	xianxian.exe

pid	process
1760	738563252e06801fa79207d33f6d431f16c341f8519d1b850130628f7b80d974.exe

Suspicious use of UnmapMainImage 4 IoCs

Processes:

738563252e06801fa79207d33f6d431f16c341f8519d1b850130628f7b80d974.exe738563252e06801fa79207d33f6d431f16c341f8519d1b850130628f7b80d974.exexianxian.exexianxian.exe

pid	process
296	738563252e06801fa79207d33f6d431f16c341f8519d1b850130628f7b80d974.exe
1760	738563252e06801fa79207d33f6d431f16c341f8519d1b850130628f7b80d974.exe
1336	xianxian.exe
1292	xianxian.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

738563252e06801fa79207d33f6d431f16c341f8519d1b850130628f7b80d974.exexianxian.exe

description	pid	process	target process
PID 296 wrote to memory of 1760	296	738563252e06801fa79207d33f6d431f16c341f8519d1b850130628f7b80d974.exe	738563252e06801fa79207d33f6d431f16c341f8519d1b850130628f7b80d974.exe
PID 296 wrote to memory of 1760	296	738563252e06801fa79207d33f6d431f16c341f8519d1b850130628f7b80d974.exe	738563252e06801fa79207d33f6d431f16c341f8519d1b850130628f7b80d974.exe
PID 296 wrote to memory of 1760	296	738563252e06801fa79207d33f6d431f16c341f8519d1b850130628f7b80d974.exe	738563252e06801fa79207d33f6d431f16c341f8519d1b850130628f7b80d974.exe
PID 296 wrote to memory of 1760	296	738563252e06801fa79207d33f6d431f16c341f8519d1b850130628f7b80d974.exe	738563252e06801fa79207d33f6d431f16c341f8519d1b850130628f7b80d974.exe
PID 1336 wrote to memory of 1292	1336	xianxian.exe	xianxian.exe
PID 1336 wrote to memory of 1292	1336	xianxian.exe	xianxian.exe
PID 1336 wrote to memory of 1292	1336	xianxian.exe	xianxian.exe
PID 1336 wrote to memory of 1292	1336	xianxian.exe	xianxian.exe

C:\Users\Admin\AppData\Local\Temp\738563252e06801fa79207d33f6d431f16c341f8519d1b850130628f7b80d974.exe
"C:\Users\Admin\AppData\Local\Temp\738563252e06801fa79207d33f6d431f16c341f8519d1b850130628f7b80d974.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:296

C:\Users\Admin\AppData\Local\Temp\738563252e06801fa79207d33f6d431f16c341f8519d1b850130628f7b80d974.exe
--e31c87f3
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:1760

C:\Windows\SysWOW64\xianxian.exe
"C:\Windows\SysWOW64\xianxian.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\SysWOW64\xianxian.exe
--64c3f38e
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1292

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/296-59-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/296-60-0x0000000000220000-0x0000000000231000-memory.dmp

Filesize
68KB

Download
memory/296-63-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1292-68-0x0000000000000000-mapping.dmp

Download
memory/1336-69-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1760-61-0x0000000000000000-mapping.dmp

Download
memory/1760-65-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads