emotet | 0d83f49d4074d4e69c725725eb1f64d12b5dc28554ff320b4c5164fc35da2dbd

General

Target

0d83f49d4074d4e69c725725eb1f64d12b5dc28554ff320b4c5164fc35da2dbd.exe
Size

70KB
MD5

04d2faf1ebd3cd7702da40bcdffb3a68
SHA1

92eba2805cb13e85a5bd8cdec0c64920a7f9cd8f
SHA256

0d83f49d4074d4e69c725725eb1f64d12b5dc28554ff320b4c5164fc35da2dbd
SHA512

1d5c4caf1c0347ba8bbc114cb4fd9cd5daf7fd430c7d5feb527cc57853da03b8f63e598587ddd6cc3b2b330412403a6315ad45c677eb1a131735697de1d93601

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

twocursor.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	twocursor.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	twocursor.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	twocursor.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	twocursor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

twocursor.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	twocursor.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	twocursor.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	twocursor.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

twocursor.exe

pid process

3408 twocursor.exe
3408 twocursor.exe
3408 twocursor.exe
3408 twocursor.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

0d83f49d4074d4e69c725725eb1f64d12b5dc28554ff320b4c5164fc35da2dbd.exe

pid process

60 0d83f49d4074d4e69c725725eb1f64d12b5dc28554ff320b4c5164fc35da2dbd.exe

pid	process
3408	twocursor.exe
3408	twocursor.exe
3408	twocursor.exe
3408	twocursor.exe

pid	process
60	0d83f49d4074d4e69c725725eb1f64d12b5dc28554ff320b4c5164fc35da2dbd.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

0d83f49d4074d4e69c725725eb1f64d12b5dc28554ff320b4c5164fc35da2dbd.exetwocursor.exe

description	pid	process	target process
PID 3452 wrote to memory of 60	3452	0d83f49d4074d4e69c725725eb1f64d12b5dc28554ff320b4c5164fc35da2dbd.exe	0d83f49d4074d4e69c725725eb1f64d12b5dc28554ff320b4c5164fc35da2dbd.exe
PID 3452 wrote to memory of 60	3452	0d83f49d4074d4e69c725725eb1f64d12b5dc28554ff320b4c5164fc35da2dbd.exe	0d83f49d4074d4e69c725725eb1f64d12b5dc28554ff320b4c5164fc35da2dbd.exe
PID 3452 wrote to memory of 60	3452	0d83f49d4074d4e69c725725eb1f64d12b5dc28554ff320b4c5164fc35da2dbd.exe	0d83f49d4074d4e69c725725eb1f64d12b5dc28554ff320b4c5164fc35da2dbd.exe
PID 4036 wrote to memory of 3408	4036	twocursor.exe	twocursor.exe
PID 4036 wrote to memory of 3408	4036	twocursor.exe	twocursor.exe
PID 4036 wrote to memory of 3408	4036	twocursor.exe	twocursor.exe

C:\Users\Admin\AppData\Local\Temp\0d83f49d4074d4e69c725725eb1f64d12b5dc28554ff320b4c5164fc35da2dbd.exe
"C:\Users\Admin\AppData\Local\Temp\0d83f49d4074d4e69c725725eb1f64d12b5dc28554ff320b4c5164fc35da2dbd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Users\Admin\AppData\Local\Temp\0d83f49d4074d4e69c725725eb1f64d12b5dc28554ff320b4c5164fc35da2dbd.exe
  --f561cee1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:60

C:\Windows\SysWOW64\twocursor.exe
"C:\Windows\SysWOW64\twocursor.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Windows\SysWOW64\twocursor.exe
  --acd6d478
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3408

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads