emotet | af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784

General

Target

af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe
Size

65KB
MD5

0bba6c71db455965f4ebd76de79ee74f
SHA1

8343aafa8f82aaad2b49f1f69cf43bb023dbd682
SHA256

af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784
SHA512

a030ae0a1c27b4d197e21b2b9afc0e305411647345e4ef26cc1ec0ef5dbf9eb9f6a844d3fe213248b0cbd9ff1b2d602b092eb71269c440f55244ea62030fdf25

Score

10^/10

emotet banker suricata trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M2
suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M2
suricata
suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M3
suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M3
suricata
suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M4
suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M4
suricata

Drops file in System32 directory 1 IoCs

Processes:

mediamedia.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mediamedia.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

mediamedia.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mediamedia.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mediamedia.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mediamedia.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5A164389-A707-4E71-9D14-319BCC4C401D}\WpadDecision = "0"	mediamedia.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5A164389-A707-4E71-9D14-319BCC4C401D}\WpadNetworkName = "Network 3"	mediamedia.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-6d-3c-cc-f4-b1	mediamedia.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-6d-3c-cc-f4-b1\WpadDecisionReason = "1"	mediamedia.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mediamedia.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mediamedia.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mediamedia.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5A164389-A707-4E71-9D14-319BCC4C401D}	mediamedia.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5A164389-A707-4E71-9D14-319BCC4C401D}\WpadDecisionReason = "1"	mediamedia.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-6d-3c-cc-f4-b1\WpadDecisionTime = 905ab6d47931d801	mediamedia.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mediamedia.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mediamedia.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mediamedia.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5A164389-A707-4E71-9D14-319BCC4C401D}\WpadDecisionTime = 905ab6d47931d801	mediamedia.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5A164389-A707-4E71-9D14-319BCC4C401D}\82-6d-3c-cc-f4-b1	mediamedia.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-6d-3c-cc-f4-b1\WpadDecision = "0"	mediamedia.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mediamedia.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mediamedia.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

mediamedia.exe

pid process

1164 mediamedia.exe
1164 mediamedia.exe
1164 mediamedia.exe
1164 mediamedia.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe

pid process

1600 af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe

pid	process
1164	mediamedia.exe
1164	mediamedia.exe
1164	mediamedia.exe
1164	mediamedia.exe

pid	process
1600	af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exemediamedia.exe

description	pid	process	target process
PID 1616 wrote to memory of 1600	1616	af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe	af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe
PID 1616 wrote to memory of 1600	1616	af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe	af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe
PID 1616 wrote to memory of 1600	1616	af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe	af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe
PID 1616 wrote to memory of 1600	1616	af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe	af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe
PID 1160 wrote to memory of 1164	1160	mediamedia.exe	mediamedia.exe
PID 1160 wrote to memory of 1164	1160	mediamedia.exe	mediamedia.exe
PID 1160 wrote to memory of 1164	1160	mediamedia.exe	mediamedia.exe
PID 1160 wrote to memory of 1164	1160	mediamedia.exe	mediamedia.exe

C:\Users\Admin\AppData\Local\Temp\af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe
"C:\Users\Admin\AppData\Local\Temp\af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Users\Admin\AppData\Local\Temp\af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe
  --6516a9ef
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1600

C:\Windows\SysWOW64\mediamedia.exe
"C:\Windows\SysWOW64\mediamedia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\mediamedia.exe
  --50d97812
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1600-54-0x0000000076731000-0x0000000076733000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads