emotet | 3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284

General

Target

3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe
Size

78KB
MD5

418d7fdd5b8335b722285f5a331e814e
SHA1

c30d2c1b23a71f3ae9d0ce09fc960848127a704f
SHA256

3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284
SHA512

d8058433598bfdc62c56b2a58a4e8d93e4e5dd5d5e63ed531bc999edf038f7675161141a2da242b740f846e23a3758c2a21d1fb06c2a365ce29fcd7724847723

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

sortedviolet.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	sortedviolet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

sortedviolet.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	sortedviolet.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	sortedviolet.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	sortedviolet.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-63-c1-d4-8a-b8\WpadDecision = "0"	sortedviolet.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	sortedviolet.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	sortedviolet.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D30ABE8B-D206-49DC-A416-17EBD1F6D19C}	sortedviolet.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D30ABE8B-D206-49DC-A416-17EBD1F6D19C}\WpadDecisionReason = "1"	sortedviolet.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-63-c1-d4-8a-b8	sortedviolet.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D30ABE8B-D206-49DC-A416-17EBD1F6D19C}\86-63-c1-d4-8a-b8	sortedviolet.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	sortedviolet.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	sortedviolet.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	sortedviolet.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D30ABE8B-D206-49DC-A416-17EBD1F6D19C}\WpadDecisionTime = 80563fa9b227d801	sortedviolet.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-63-c1-d4-8a-b8\WpadDecisionReason = "1"	sortedviolet.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-63-c1-d4-8a-b8\WpadDecisionTime = 80563fa9b227d801	sortedviolet.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	sortedviolet.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0086000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	sortedviolet.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D30ABE8B-D206-49DC-A416-17EBD1F6D19C}\WpadDecision = "0"	sortedviolet.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D30ABE8B-D206-49DC-A416-17EBD1F6D19C}\WpadNetworkName = "Network 3"	sortedviolet.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	sortedviolet.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

sortedviolet.exe

pid process

816 sortedviolet.exe
816 sortedviolet.exe
816 sortedviolet.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe

pid process

1720 3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe

pid	process
816	sortedviolet.exe
816	sortedviolet.exe
816	sortedviolet.exe

pid	process
1720	3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exesortedviolet.exe

description	pid	process	target process
PID 1500 wrote to memory of 1720	1500	3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe	3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe
PID 1500 wrote to memory of 1720	1500	3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe	3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe
PID 1500 wrote to memory of 1720	1500	3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe	3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe
PID 1500 wrote to memory of 1720	1500	3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe	3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe
PID 1556 wrote to memory of 816	1556	sortedviolet.exe	sortedviolet.exe
PID 1556 wrote to memory of 816	1556	sortedviolet.exe	sortedviolet.exe
PID 1556 wrote to memory of 816	1556	sortedviolet.exe	sortedviolet.exe
PID 1556 wrote to memory of 816	1556	sortedviolet.exe	sortedviolet.exe

C:\Users\Admin\AppData\Local\Temp\3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe
"C:\Users\Admin\AppData\Local\Temp\3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1500

C:\Users\Admin\AppData\Local\Temp\3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe
--d1b2e1a8
2⤵
- Suspicious behavior: RenamesItself
PID:1720

C:\Windows\SysWOW64\sortedviolet.exe
"C:\Windows\SysWOW64\sortedviolet.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\SysWOW64\sortedviolet.exe
--ec74830e
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:816

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-55-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads