emotet | 0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a

General

Target

0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a.exe
Size

202KB
MD5

beaf5e523e8e3e3fb9dc2a361cda0573
SHA1

b038caeed3466c07c5f473bfd6c5bd11e5afccf1
SHA256

0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a
SHA512

f0692ff4b5b2278952806b183246a96077c893d2487c5023b56bbccfbd8d16f09dd9394aae8cc71d33ad8b3d9474f4e7825bcccc0f24029eaa753d131fc8a683

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

earconsingle.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	earconsingle.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

earconsingle.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	earconsingle.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{36BB1C40-4278-45ED-B668-4AD9A6D6D3C3}	earconsingle.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	earconsingle.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	earconsingle.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	earconsingle.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	earconsingle.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	earconsingle.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{36BB1C40-4278-45ED-B668-4AD9A6D6D3C3}\WpadNetworkName = "Network 3"	earconsingle.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-a3-1c-ef-79-ca	earconsingle.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	earconsingle.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	earconsingle.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	earconsingle.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{36BB1C40-4278-45ED-B668-4AD9A6D6D3C3}\WpadDecisionReason = "1"	earconsingle.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{36BB1C40-4278-45ED-B668-4AD9A6D6D3C3}\WpadDecision = "0"	earconsingle.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-a3-1c-ef-79-ca\WpadDecisionReason = "1"	earconsingle.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-a3-1c-ef-79-ca\WpadDecision = "0"	earconsingle.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	earconsingle.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	earconsingle.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{36BB1C40-4278-45ED-B668-4AD9A6D6D3C3}\WpadDecisionTime = 508a03492728d801	earconsingle.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{36BB1C40-4278-45ED-B668-4AD9A6D6D3C3}\06-a3-1c-ef-79-ca	earconsingle.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-a3-1c-ef-79-ca\WpadDecisionTime = 508a03492728d801	earconsingle.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a.exe0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a.exeearconsingle.exeearconsingle.exe

pid	process
1676	0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a.exe
1628	0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a.exe
656	earconsingle.exe
540	earconsingle.exe
540	earconsingle.exe
540	earconsingle.exe
540	earconsingle.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a.exe

pid process

1628 0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a.exe

pid	process
1628	0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a.exe

Suspicious use of UnmapMainImage 4 IoCs

Processes:

0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a.exe0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a.exeearconsingle.exeearconsingle.exe

pid	process
1676	0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a.exe
1628	0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a.exe
656	earconsingle.exe
540	earconsingle.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a.exeearconsingle.exe

description	pid	process	target process
PID 1676 wrote to memory of 1628	1676	0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a.exe	0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a.exe
PID 1676 wrote to memory of 1628	1676	0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a.exe	0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a.exe
PID 1676 wrote to memory of 1628	1676	0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a.exe	0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a.exe
PID 1676 wrote to memory of 1628	1676	0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a.exe	0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a.exe
PID 656 wrote to memory of 540	656	earconsingle.exe	earconsingle.exe
PID 656 wrote to memory of 540	656	earconsingle.exe	earconsingle.exe
PID 656 wrote to memory of 540	656	earconsingle.exe	earconsingle.exe
PID 656 wrote to memory of 540	656	earconsingle.exe	earconsingle.exe

C:\Users\Admin\AppData\Local\Temp\0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a.exe
"C:\Users\Admin\AppData\Local\Temp\0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1676

C:\Users\Admin\AppData\Local\Temp\0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a.exe
"C:\Users\Admin\AppData\Local\Temp\0fe713faf94bed3424ce7c7ac576db24cbb50e989f87b6844865971aed98b24a.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:1628

C:\Windows\SysWOW64\earconsingle.exe
"C:\Windows\SysWOW64\earconsingle.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:656

C:\Windows\SysWOW64\earconsingle.exe
"C:\Windows\SysWOW64\earconsingle.exe"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:540

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/540-62-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1628-59-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1676-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1676-56-0x0000000000220000-0x0000000000232000-memory.dmp

Filesize
72KB

Download
memory/1676-58-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads