emotet | 3172a83195215e12f5817d1cf310fd1571b6d4c299e95dd9502f5817475dc7de

General

Target

3172a83195215e12f5817d1cf310fd1571b6d4c299e95dd9502f5817475dc7de.exe
Size

57KB
MD5

47f484a5f13fc693edc664e0fd9beec7
SHA1

1d6610795dacc878d7a547100a477c5bcadf5174
SHA256

3172a83195215e12f5817d1cf310fd1571b6d4c299e95dd9502f5817475dc7de
SHA512

46d92575b94d8016902f7570fb1048134e4f869a112387d2bcc044ee6dc01f4e816d4f24c68f04b4adefa05d4a7677ce71862158bbcf064a0082f11973c9aaa2

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

russtarted.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	russtarted.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 25 IoCs

Processes:

russtarted.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	russtarted.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	russtarted.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	russtarted.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0096000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	russtarted.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-67-74-78-73-77	russtarted.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{23B1BC38-9579-4966-AC8E-9B7E61474526}\3e-67-74-78-73-77	russtarted.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-67-74-78-73-77\WpadDetectedUrl	russtarted.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	russtarted.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-67-74-78-73-77\WpadDecisionTime = 7097a652bc27d801	russtarted.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	russtarted.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	russtarted.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	russtarted.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{23B1BC38-9579-4966-AC8E-9B7E61474526}	russtarted.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{23B1BC38-9579-4966-AC8E-9B7E61474526}\WpadDecisionReason = "1"	russtarted.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0096000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	russtarted.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{23B1BC38-9579-4966-AC8E-9B7E61474526}\WpadDecisionTime = 7097a652bc27d801	russtarted.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	russtarted.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{23B1BC38-9579-4966-AC8E-9B7E61474526}\WpadNetworkName = "Network 3"	russtarted.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-67-74-78-73-77\WpadDecisionReason = "1"	russtarted.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-67-74-78-73-77\WpadDecisionTime = f0d8e713bc27d801	russtarted.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-67-74-78-73-77\WpadDecision = "0"	russtarted.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	russtarted.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{23B1BC38-9579-4966-AC8E-9B7E61474526}\WpadDecisionTime = f0d8e713bc27d801	russtarted.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{23B1BC38-9579-4966-AC8E-9B7E61474526}\WpadDecision = "0"	russtarted.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	russtarted.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

russtarted.exe

pid process

560 russtarted.exe
560 russtarted.exe
560 russtarted.exe
560 russtarted.exe
560 russtarted.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

3172a83195215e12f5817d1cf310fd1571b6d4c299e95dd9502f5817475dc7de.exe

pid process

1072 3172a83195215e12f5817d1cf310fd1571b6d4c299e95dd9502f5817475dc7de.exe

pid	process
560	russtarted.exe
560	russtarted.exe
560	russtarted.exe
560	russtarted.exe
560	russtarted.exe

pid	process
1072	3172a83195215e12f5817d1cf310fd1571b6d4c299e95dd9502f5817475dc7de.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

3172a83195215e12f5817d1cf310fd1571b6d4c299e95dd9502f5817475dc7de.exerusstarted.exe

description	pid	process	target process
PID 1876 wrote to memory of 1072	1876	3172a83195215e12f5817d1cf310fd1571b6d4c299e95dd9502f5817475dc7de.exe	3172a83195215e12f5817d1cf310fd1571b6d4c299e95dd9502f5817475dc7de.exe
PID 1876 wrote to memory of 1072	1876	3172a83195215e12f5817d1cf310fd1571b6d4c299e95dd9502f5817475dc7de.exe	3172a83195215e12f5817d1cf310fd1571b6d4c299e95dd9502f5817475dc7de.exe
PID 1876 wrote to memory of 1072	1876	3172a83195215e12f5817d1cf310fd1571b6d4c299e95dd9502f5817475dc7de.exe	3172a83195215e12f5817d1cf310fd1571b6d4c299e95dd9502f5817475dc7de.exe
PID 1876 wrote to memory of 1072	1876	3172a83195215e12f5817d1cf310fd1571b6d4c299e95dd9502f5817475dc7de.exe	3172a83195215e12f5817d1cf310fd1571b6d4c299e95dd9502f5817475dc7de.exe
PID 1064 wrote to memory of 560	1064	russtarted.exe	russtarted.exe
PID 1064 wrote to memory of 560	1064	russtarted.exe	russtarted.exe
PID 1064 wrote to memory of 560	1064	russtarted.exe	russtarted.exe
PID 1064 wrote to memory of 560	1064	russtarted.exe	russtarted.exe

C:\Users\Admin\AppData\Local\Temp\3172a83195215e12f5817d1cf310fd1571b6d4c299e95dd9502f5817475dc7de.exe
"C:\Users\Admin\AppData\Local\Temp\3172a83195215e12f5817d1cf310fd1571b6d4c299e95dd9502f5817475dc7de.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1876

C:\Users\Admin\AppData\Local\Temp\3172a83195215e12f5817d1cf310fd1571b6d4c299e95dd9502f5817475dc7de.exe
--a6986577
2⤵
- Suspicious behavior: RenamesItself
PID:1072

C:\Windows\SysWOW64\russtarted.exe
"C:\Windows\SysWOW64\russtarted.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\russtarted.exe
--7e55a203
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:560

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1072-55-0x00000000760F1000-0x00000000760F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads