emotet | 7f78a78612fecd565ef1c3125ad1df1c9bdd210d4f97a0828c49941ad159cb68

Resubmissions

16-09-2021 11:50

210916-nzpyxsdcc5 10

16-09-2021 11:45

210916-nw243sdcb9 10

Analysis

max time kernel
1800s
max time network
1801s
platform
windows7_x64
resource
win7-en
submitted
16-09-2021 11:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d08df2a4dd3c1f2b8f99a541acf61f088f5659caf27da9472205ac2ea2d47790.exe
Size

474KB
MD5

591d2b97f834d2c95667850564e8fbe2
SHA1

cf28700496e977e7a4e01c02f20b954a01d89878
SHA256

d08df2a4dd3c1f2b8f99a541acf61f088f5659caf27da9472205ac2ea2d47790
SHA512

1a112bde7e667a85706d67c89663d2ec4e2dfe9bfc2a861f42d0761e633d45c93041363cffa49ed45de249e9c19373c497f8d2900288c80d36a74d14eb80e89c

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

124.240.198.66:80

186.75.241.230:80

181.143.194.138:443

45.79.188.67:8080

77.237.248.136:8080

185.142.236.163:443

63.142.253.122:8080

178.254.6.27:7080

190.211.207.11:443

78.188.105.159:21

182.176.106.43:995

178.79.161.166:443

206.189.98.125:8080

87.230.19.21:8080

80.11.163.139:443

101.187.237.217:20

190.18.146.70:80

86.98.25.30:53

92.222.125.16:7080

186.4.172.5:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

violetcounter.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	violetcounter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

Processes:

violetcounter.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA37F155-B5BF-408E-8112-2AE36EF2A5CE}\WpadDecision = "0"	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000008000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a000046000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-22-9b-50-38-c8\WpadDecisionTime = f052a1fdf3aad701	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA37F155-B5BF-408E-8112-2AE36EF2A5CE}\WpadDecisionTime = 70d16fc6f4aad701	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-22-9b-50-38-c8\WpadDecisionTime = 308cc1eaf4aad701	violetcounter.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	violetcounter.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-22-9b-50-38-c8\WpadDecisionTime = 10837095f1aad701	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	violetcounter.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-22-9b-50-38-c8\WpadDecisionTime = d09b961ef1aad701	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA37F155-B5BF-408E-8112-2AE36EF2A5CE}\WpadDecisionTime = 50da4825f2aad701	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-22-9b-50-38-c8\WpadDecisionTime = b0c0a7caf2aad701	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-22-9b-50-38-c8\WpadDecisionTime = 10421b57f3aad701	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-22-9b-50-38-c8\WpadDecisionTime = 90179973f4aad701	violetcounter.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000005000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a000046000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 460000000f000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a000046000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	violetcounter.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	violetcounter.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA37F155-B5BF-408E-8112-2AE36EF2A5CE}	violetcounter.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-22-9b-50-38-c8	violetcounter.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-22-9b-50-38-c8\WpadDecisionReason = "1"	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-22-9b-50-38-c8\WpadDecisionTime = d02e66e8f1aad701	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-22-9b-50-38-c8\WpadDecisionTime = 50da4825f2aad701	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA37F155-B5BF-408E-8112-2AE36EF2A5CE}\WpadDecisionTime = 10421b57f3aad701	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 460000000c000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a000046000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-22-9b-50-38-c8\WpadDecisionTime = 70d993aaf3aad701	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-22-9b-50-38-c8\WpadDecisionTime = 70d16fc6f4aad701	violetcounter.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000009000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a000046000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000010000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a000046000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	violetcounter.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-22-9b-50-38-c8\WpadDecision = "0"	violetcounter.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA37F155-B5BF-408E-8112-2AE36EF2A5CE}\WpadDecisionTime = 90ad8170f1aad701	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000006000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a000046000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-22-9b-50-38-c8\WpadDecisionTime = 90216e78f2aad701	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA37F155-B5BF-408E-8112-2AE36EF2A5CE}\WpadDecisionTime = b0c0a7caf2aad701	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-22-9b-50-38-c8\WpadDecisionTime = d0ec9805f3aad701	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA37F155-B5BF-408E-8112-2AE36EF2A5CE}\WpadDecisionTime = d043d750f4aad701	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA37F155-B5BF-408E-8112-2AE36EF2A5CE}\WpadDecisionTime = 90179973f4aad701	violetcounter.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA37F155-B5BF-408E-8112-2AE36EF2A5CE}\56-22-9b-50-38-c8	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA37F155-B5BF-408E-8112-2AE36EF2A5CE}\WpadDecisionTime = f052a1fdf3aad701	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA37F155-B5BF-408E-8112-2AE36EF2A5CE}\WpadDecisionTime = d0ec9805f3aad701	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 460000000d000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a000046000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-22-9b-50-38-c8\WpadDecisionTime = 90ad8170f1aad701	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 460000000a000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a000046000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 460000000b000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a000046000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a000046000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a000046000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000007000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a000046000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA37F155-B5BF-408E-8112-2AE36EF2A5CE}\WpadDecisionTime = 70d993aaf3aad701	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-22-9b-50-38-c8\WpadDecisionTime = d043d750f4aad701	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA37F155-B5BF-408E-8112-2AE36EF2A5CE}\WpadDecisionTime = 308cc1eaf4aad701	violetcounter.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	violetcounter.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-22-9b-50-38-c8\WpadDetectedUrl	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 460000000e000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a000046000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA37F155-B5BF-408E-8112-2AE36EF2A5CE}\WpadDecisionTime = 90216e78f2aad701	violetcounter.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA37F155-B5BF-408E-8112-2AE36EF2A5CE}\WpadDecisionReason = "1"	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA37F155-B5BF-408E-8112-2AE36EF2A5CE}\WpadDecisionTime = d09b961ef1aad701	violetcounter.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA37F155-B5BF-408E-8112-2AE36EF2A5CE}\WpadNetworkName = "Network 3"	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA37F155-B5BF-408E-8112-2AE36EF2A5CE}\WpadDecisionTime = 10837095f1aad701	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FA37F155-B5BF-408E-8112-2AE36EF2A5CE}\WpadDecisionTime = d02e66e8f1aad701	violetcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000011000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a000046000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	violetcounter.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

Processes:

violetcounter.exe

pid	process
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe
1692	violetcounter.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

d08df2a4dd3c1f2b8f99a541acf61f088f5659caf27da9472205ac2ea2d47790.exe

pid process

1504 d08df2a4dd3c1f2b8f99a541acf61f088f5659caf27da9472205ac2ea2d47790.exe

pid	process
1504	d08df2a4dd3c1f2b8f99a541acf61f088f5659caf27da9472205ac2ea2d47790.exe

Suspicious use of UnmapMainImage 4 IoCs

Processes:

d08df2a4dd3c1f2b8f99a541acf61f088f5659caf27da9472205ac2ea2d47790.exed08df2a4dd3c1f2b8f99a541acf61f088f5659caf27da9472205ac2ea2d47790.exevioletcounter.exevioletcounter.exe

pid	process
2024	d08df2a4dd3c1f2b8f99a541acf61f088f5659caf27da9472205ac2ea2d47790.exe
1504	d08df2a4dd3c1f2b8f99a541acf61f088f5659caf27da9472205ac2ea2d47790.exe
1016	violetcounter.exe
1692	violetcounter.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

d08df2a4dd3c1f2b8f99a541acf61f088f5659caf27da9472205ac2ea2d47790.exevioletcounter.exe

description	pid	process	target process
PID 2024 wrote to memory of 1504	2024	d08df2a4dd3c1f2b8f99a541acf61f088f5659caf27da9472205ac2ea2d47790.exe	d08df2a4dd3c1f2b8f99a541acf61f088f5659caf27da9472205ac2ea2d47790.exe
PID 2024 wrote to memory of 1504	2024	d08df2a4dd3c1f2b8f99a541acf61f088f5659caf27da9472205ac2ea2d47790.exe	d08df2a4dd3c1f2b8f99a541acf61f088f5659caf27da9472205ac2ea2d47790.exe
PID 2024 wrote to memory of 1504	2024	d08df2a4dd3c1f2b8f99a541acf61f088f5659caf27da9472205ac2ea2d47790.exe	d08df2a4dd3c1f2b8f99a541acf61f088f5659caf27da9472205ac2ea2d47790.exe
PID 2024 wrote to memory of 1504	2024	d08df2a4dd3c1f2b8f99a541acf61f088f5659caf27da9472205ac2ea2d47790.exe	d08df2a4dd3c1f2b8f99a541acf61f088f5659caf27da9472205ac2ea2d47790.exe
PID 1016 wrote to memory of 1692	1016	violetcounter.exe	violetcounter.exe
PID 1016 wrote to memory of 1692	1016	violetcounter.exe	violetcounter.exe
PID 1016 wrote to memory of 1692	1016	violetcounter.exe	violetcounter.exe
PID 1016 wrote to memory of 1692	1016	violetcounter.exe	violetcounter.exe

C:\Users\Admin\AppData\Local\Temp\d08df2a4dd3c1f2b8f99a541acf61f088f5659caf27da9472205ac2ea2d47790.exe
"C:\Users\Admin\AppData\Local\Temp\d08df2a4dd3c1f2b8f99a541acf61f088f5659caf27da9472205ac2ea2d47790.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2024

C:\Users\Admin\AppData\Local\Temp\d08df2a4dd3c1f2b8f99a541acf61f088f5659caf27da9472205ac2ea2d47790.exe
--35f827d5
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:1504

C:\Windows\SysWOW64\violetcounter.exe
"C:\Windows\SysWOW64\violetcounter.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1016

C:\Windows\SysWOW64\violetcounter.exe
--a0cab773
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1692

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1504-55-0x0000000000000000-mapping.dmp

Download
memory/1692-59-0x0000000000000000-mapping.dmp

Download
memory/2024-53-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/2024-54-0x0000000000270000-0x0000000000285000-memory.dmp

Filesize
84KB

Download
memory/2024-57-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download