emotet | 3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284

General

Target

3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe
Size

78KB
MD5

418d7fdd5b8335b722285f5a331e814e
SHA1

c30d2c1b23a71f3ae9d0ce09fc960848127a704f
SHA256

3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284
SHA512

d8058433598bfdc62c56b2a58a4e8d93e4e5dd5d5e63ed531bc999edf038f7675161141a2da242b740f846e23a3758c2a21d1fb06c2a365ce29fcd7724847723

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

defsrtapi.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	defsrtapi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	defsrtapi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	defsrtapi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	defsrtapi.exe

Drops file in Windows directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

defsrtapi.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	defsrtapi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	defsrtapi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	defsrtapi.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

defsrtapi.exe

pid	process
2324	defsrtapi.exe
2324	defsrtapi.exe
2324	defsrtapi.exe
2324	defsrtapi.exe
2324	defsrtapi.exe
2324	defsrtapi.exe
2324	defsrtapi.exe
2324	defsrtapi.exe
2324	defsrtapi.exe
2324	defsrtapi.exe
2324	defsrtapi.exe
2324	defsrtapi.exe
2324	defsrtapi.exe
2324	defsrtapi.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe

pid process

2552 3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe

pid	process
2552	3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeShutdownPrivilege	3276	svchost.exe
Token: SeCreatePagefilePrivilege	3276	svchost.exe
Token: SeShutdownPrivilege	3276	svchost.exe
Token: SeCreatePagefilePrivilege	3276	svchost.exe
Token: SeShutdownPrivilege	3276	svchost.exe
Token: SeCreatePagefilePrivilege	3276	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exedefsrtapi.exe

description	pid	process	target process
PID 2096 wrote to memory of 2552	2096	3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe	3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe
PID 2096 wrote to memory of 2552	2096	3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe	3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe
PID 2096 wrote to memory of 2552	2096	3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe	3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe
PID 1708 wrote to memory of 2324	1708	defsrtapi.exe	defsrtapi.exe
PID 1708 wrote to memory of 2324	1708	defsrtapi.exe	defsrtapi.exe
PID 1708 wrote to memory of 2324	1708	defsrtapi.exe	defsrtapi.exe

C:\Users\Admin\AppData\Local\Temp\3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe
"C:\Users\Admin\AppData\Local\Temp\3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2096

C:\Users\Admin\AppData\Local\Temp\3420914c8699d86540e351d0dfc792504cb31602eac5c8aaf61f47a81078f284.exe
--d1b2e1a8
2⤵
- Suspicious behavior: RenamesItself
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3276

C:\Windows\SysWOW64\defsrtapi.exe
"C:\Windows\SysWOW64\defsrtapi.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\defsrtapi.exe
--e3200c00
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2324

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3276-130-0x000001BBBBD60000-0x000001BBBBD70000-memory.dmp

Filesize
64KB

Download
memory/3276-131-0x000001BBBC320000-0x000001BBBC330000-memory.dmp

Filesize
64KB

Download
memory/3276-132-0x000001BBBE9E0000-0x000001BBBE9E4000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads