emotet | fe67208312a732b43e261eae866db9d0387728033863fc10bf84ddfee49ccdab

General

Target

fe67208312a732b43e261eae866db9d0387728033863fc10bf84ddfee49ccdab.exe
Size

149KB
MD5

4e8a94ca8cdadfe9c269907a1565deff
SHA1

95c0bb6b8b7790f29d0d7290cbd3201772a8d866
SHA256

fe67208312a732b43e261eae866db9d0387728033863fc10bf84ddfee49ccdab
SHA512

2c05aee7485339e00152717873b581a7e0ed35acf61de97fac3d813cfb5072bf4354cfff486dd02040cfa5bedadbdc7fe6263ae891900d9c5b3794c6631ea585

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 5 IoCs

Processes:

bearssmall.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	bearssmall.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	bearssmall.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	bearssmall.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	bearssmall.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	bearssmall.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

bearssmall.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	bearssmall.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	bearssmall.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	bearssmall.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

bearssmall.exe

pid	process
3420	bearssmall.exe
3420	bearssmall.exe
3420	bearssmall.exe
3420	bearssmall.exe
3420	bearssmall.exe
3420	bearssmall.exe
3420	bearssmall.exe
3420	bearssmall.exe
3420	bearssmall.exe
3420	bearssmall.exe
3420	bearssmall.exe
3420	bearssmall.exe
3420	bearssmall.exe
3420	bearssmall.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

fe67208312a732b43e261eae866db9d0387728033863fc10bf84ddfee49ccdab.exe

pid process

2660 fe67208312a732b43e261eae866db9d0387728033863fc10bf84ddfee49ccdab.exe

pid	process
2660	fe67208312a732b43e261eae866db9d0387728033863fc10bf84ddfee49ccdab.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

fe67208312a732b43e261eae866db9d0387728033863fc10bf84ddfee49ccdab.exebearssmall.exe

description	pid	process	target process
PID 740 wrote to memory of 2660	740	fe67208312a732b43e261eae866db9d0387728033863fc10bf84ddfee49ccdab.exe	fe67208312a732b43e261eae866db9d0387728033863fc10bf84ddfee49ccdab.exe
PID 740 wrote to memory of 2660	740	fe67208312a732b43e261eae866db9d0387728033863fc10bf84ddfee49ccdab.exe	fe67208312a732b43e261eae866db9d0387728033863fc10bf84ddfee49ccdab.exe
PID 740 wrote to memory of 2660	740	fe67208312a732b43e261eae866db9d0387728033863fc10bf84ddfee49ccdab.exe	fe67208312a732b43e261eae866db9d0387728033863fc10bf84ddfee49ccdab.exe
PID 784 wrote to memory of 3420	784	bearssmall.exe	bearssmall.exe
PID 784 wrote to memory of 3420	784	bearssmall.exe	bearssmall.exe
PID 784 wrote to memory of 3420	784	bearssmall.exe	bearssmall.exe

C:\Users\Admin\AppData\Local\Temp\fe67208312a732b43e261eae866db9d0387728033863fc10bf84ddfee49ccdab.exe
"C:\Users\Admin\AppData\Local\Temp\fe67208312a732b43e261eae866db9d0387728033863fc10bf84ddfee49ccdab.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:740
- C:\Users\Admin\AppData\Local\Temp\fe67208312a732b43e261eae866db9d0387728033863fc10bf84ddfee49ccdab.exe
  --ca51e628
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2660

C:\Windows\SysWOW64\bearssmall.exe
"C:\Windows\SysWOW64\bearssmall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\SysWOW64\bearssmall.exe
  --7d28d5a
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3420

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/740-114-0x0000000000430000-0x000000000057A000-memory.dmp

Filesize
1.3MB

Download
memory/740-116-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/784-119-0x0000000000480000-0x0000000000491000-memory.dmp

Filesize
68KB

Download
memory/784-121-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2660-115-0x0000000000000000-mapping.dmp

Download
memory/2660-118-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2660-117-0x0000000000530000-0x000000000067A000-memory.dmp

Filesize
1.3MB

Download
memory/3420-120-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads