emotet | 12cea53b187c92750c027135784cb6366e6bf55121b6d9091fd9f8fcdfc670cf

General

Target

12cea53b187c92750c027135784cb6366e6bf55121b6d9091fd9f8fcdfc670cf.exe
Size

57KB
MD5

47ab8895fdecb378d4f47d1ca2f05dc9
SHA1

9e8f8837111543157a51c033879a3c63e001b808
SHA256

12cea53b187c92750c027135784cb6366e6bf55121b6d9091fd9f8fcdfc670cf
SHA512

73a8594be0b3444ca81a4e761c26fd3deabf4f112243508a25702add203b2993a0c967de7e2d24cf0a8299b6427fbbe5df5d63b6bf61ee1157071ae26232b792

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

tabletengine.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	tabletengine.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 25 IoCs

Processes:

tabletengine.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-31-b0-98-1d-0d\WpadDecisionTime = a0613daa1428d801	tabletengine.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	tabletengine.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	tabletengine.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	tabletengine.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B260F4A3-5057-4784-B69B-94EAF532A67C}\WpadDecisionTime = a0d464881428d801	tabletengine.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B260F4A3-5057-4784-B69B-94EAF532A67C}\WpadDecision = "0"	tabletengine.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-31-b0-98-1d-0d	tabletengine.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-31-b0-98-1d-0d\WpadDecisionReason = "1"	tabletengine.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	tabletengine.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	tabletengine.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B260F4A3-5057-4784-B69B-94EAF532A67C}	tabletengine.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B260F4A3-5057-4784-B69B-94EAF532A67C}\d6-31-b0-98-1d-0d	tabletengine.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-31-b0-98-1d-0d\WpadDecision = "0"	tabletengine.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f015d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	tabletengine.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B260F4A3-5057-4784-B69B-94EAF532A67C}\WpadDecisionTime = a0613daa1428d801	tabletengine.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	tabletengine.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	tabletengine.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f015d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	tabletengine.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B260F4A3-5057-4784-B69B-94EAF532A67C}\WpadDecisionReason = "1"	tabletengine.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B260F4A3-5057-4784-B69B-94EAF532A67C}\WpadNetworkName = "Network 2"	tabletengine.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	tabletengine.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	tabletengine.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	tabletengine.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-31-b0-98-1d-0d\WpadDecisionTime = a0d464881428d801	tabletengine.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-31-b0-98-1d-0d\WpadDetectedUrl	tabletengine.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

tabletengine.exe

pid process

756 tabletengine.exe
756 tabletengine.exe
756 tabletengine.exe
756 tabletengine.exe
756 tabletengine.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

12cea53b187c92750c027135784cb6366e6bf55121b6d9091fd9f8fcdfc670cf.exe

pid process

1488 12cea53b187c92750c027135784cb6366e6bf55121b6d9091fd9f8fcdfc670cf.exe

pid	process
756	tabletengine.exe
756	tabletengine.exe
756	tabletengine.exe
756	tabletengine.exe
756	tabletengine.exe

pid	process
1488	12cea53b187c92750c027135784cb6366e6bf55121b6d9091fd9f8fcdfc670cf.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

12cea53b187c92750c027135784cb6366e6bf55121b6d9091fd9f8fcdfc670cf.exetabletengine.exe

description	pid	process	target process
PID 1684 wrote to memory of 1488	1684	12cea53b187c92750c027135784cb6366e6bf55121b6d9091fd9f8fcdfc670cf.exe	12cea53b187c92750c027135784cb6366e6bf55121b6d9091fd9f8fcdfc670cf.exe
PID 1684 wrote to memory of 1488	1684	12cea53b187c92750c027135784cb6366e6bf55121b6d9091fd9f8fcdfc670cf.exe	12cea53b187c92750c027135784cb6366e6bf55121b6d9091fd9f8fcdfc670cf.exe
PID 1684 wrote to memory of 1488	1684	12cea53b187c92750c027135784cb6366e6bf55121b6d9091fd9f8fcdfc670cf.exe	12cea53b187c92750c027135784cb6366e6bf55121b6d9091fd9f8fcdfc670cf.exe
PID 1684 wrote to memory of 1488	1684	12cea53b187c92750c027135784cb6366e6bf55121b6d9091fd9f8fcdfc670cf.exe	12cea53b187c92750c027135784cb6366e6bf55121b6d9091fd9f8fcdfc670cf.exe
PID 268 wrote to memory of 756	268	tabletengine.exe	tabletengine.exe
PID 268 wrote to memory of 756	268	tabletengine.exe	tabletengine.exe
PID 268 wrote to memory of 756	268	tabletengine.exe	tabletengine.exe
PID 268 wrote to memory of 756	268	tabletengine.exe	tabletengine.exe

C:\Users\Admin\AppData\Local\Temp\12cea53b187c92750c027135784cb6366e6bf55121b6d9091fd9f8fcdfc670cf.exe
"C:\Users\Admin\AppData\Local\Temp\12cea53b187c92750c027135784cb6366e6bf55121b6d9091fd9f8fcdfc670cf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Users\Admin\AppData\Local\Temp\12cea53b187c92750c027135784cb6366e6bf55121b6d9091fd9f8fcdfc670cf.exe
--b419c16d
2⤵
- Suspicious behavior: RenamesItself
PID:1488

C:\Windows\SysWOW64\tabletengine.exe
"C:\Windows\SysWOW64\tabletengine.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\SysWOW64\tabletengine.exe
--76dc945a
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:756

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-54-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads