emotet | 3ce0b9ca45ae36be8a3d22ccff44a30207cd179d309b44163f74083826c9e663

General

Target

VirusShare_bae06a0ea924a105ef52dfd4cfe79187.exe
Size

112KB
MD5

bae06a0ea924a105ef52dfd4cfe79187
SHA1

9c091054350a7e14d9d8c76d6bceb3ecdfe26c61
SHA256

3ce0b9ca45ae36be8a3d22ccff44a30207cd179d309b44163f74083826c9e663
SHA512

0a3b050a39918bdce7a1c13dcac923033a9ecf9db5ffd4c744996f1f176936326f141a88932ab1d47a5deb1482dba6f6003f464fd621e831f64980c5e30545fc

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet Payload 5 IoCs

Detects Emotet payload in memory.

Processes:

resource	yara_rule
behavioral1/memory/1336-55-0x0000000000240000-0x0000000000252000-memory.dmp	emotet
behavioral1/memory/1336-58-0x0000000000261000-0x000000000026C000-memory.dmp	emotet
behavioral1/memory/1336-61-0x0000000000230000-0x000000000023F000-memory.dmp	emotet
behavioral1/memory/268-64-0x00000000001D0000-0x00000000001E2000-memory.dmp	emotet
behavioral1/memory/268-67-0x0000000000271000-0x000000000027C000-memory.dmp	emotet

Executes dropped EXE 1 IoCs

Processes:

ntmarta.exe

pid process

268 ntmarta.exe
Drops file in System32 directory 1 IoCs

Processes:

VirusShare_bae06a0ea924a105ef52dfd4cfe79187.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\softkbd\ntmarta.exe VirusShare_bae06a0ea924a105ef52dfd4cfe79187.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

ntmarta.exe

pid process

268 ntmarta.exe
268 ntmarta.exe
268 ntmarta.exe
268 ntmarta.exe
268 ntmarta.exe
268 ntmarta.exe
268 ntmarta.exe
268 ntmarta.exe
268 ntmarta.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

VirusShare_bae06a0ea924a105ef52dfd4cfe79187.exe

pid process

1336 VirusShare_bae06a0ea924a105ef52dfd4cfe79187.exe

pid	process
268	ntmarta.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\softkbd\ntmarta.exe	VirusShare_bae06a0ea924a105ef52dfd4cfe79187.exe

pid	process
268	ntmarta.exe
268	ntmarta.exe
268	ntmarta.exe
268	ntmarta.exe
268	ntmarta.exe
268	ntmarta.exe
268	ntmarta.exe
268	ntmarta.exe
268	ntmarta.exe

pid	process
1336	VirusShare_bae06a0ea924a105ef52dfd4cfe79187.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

VirusShare_bae06a0ea924a105ef52dfd4cfe79187.exe

description	pid	process	target process
PID 1336 wrote to memory of 268	1336	VirusShare_bae06a0ea924a105ef52dfd4cfe79187.exe	ntmarta.exe
PID 1336 wrote to memory of 268	1336	VirusShare_bae06a0ea924a105ef52dfd4cfe79187.exe	ntmarta.exe
PID 1336 wrote to memory of 268	1336	VirusShare_bae06a0ea924a105ef52dfd4cfe79187.exe	ntmarta.exe
PID 1336 wrote to memory of 268	1336	VirusShare_bae06a0ea924a105ef52dfd4cfe79187.exe	ntmarta.exe

C:\Users\Admin\AppData\Local\Temp\VirusShare_bae06a0ea924a105ef52dfd4cfe79187.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_bae06a0ea924a105ef52dfd4cfe79187.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\SysWOW64\softkbd\ntmarta.exe
"C:\Windows\SysWOW64\softkbd\ntmarta.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:268

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\softkbd\ntmarta.exe
MD5
bae06a0ea924a105ef52dfd4cfe79187

SHA1
9c091054350a7e14d9d8c76d6bceb3ecdfe26c61

SHA256
3ce0b9ca45ae36be8a3d22ccff44a30207cd179d309b44163f74083826c9e663

SHA512
0a3b050a39918bdce7a1c13dcac923033a9ecf9db5ffd4c744996f1f176936326f141a88932ab1d47a5deb1482dba6f6003f464fd621e831f64980c5e30545fc

Download Submit
memory/268-62-0x0000000000000000-mapping.dmp

Download
memory/268-64-0x00000000001D0000-0x00000000001E2000-memory.dmp

Filesize
72KB

Download
memory/268-67-0x0000000000271000-0x000000000027C000-memory.dmp

Filesize
44KB

Download
memory/1336-55-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/1336-58-0x0000000000261000-0x000000000026C000-memory.dmp

Filesize
44KB

Download
memory/1336-59-0x000000000026C000-0x000000000026D000-memory.dmp

Filesize
4KB

Download
memory/1336-60-0x0000000075B71000-0x0000000075B73000-memory.dmp

Filesize
8KB

Download
memory/1336-61-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing