emotet | af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784

General

Target

af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe
Size

65KB
MD5

0bba6c71db455965f4ebd76de79ee74f
SHA1

8343aafa8f82aaad2b49f1f69cf43bb023dbd682
SHA256

af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784
SHA512

a030ae0a1c27b4d197e21b2b9afc0e305411647345e4ef26cc1ec0ef5dbf9eb9f6a844d3fe213248b0cbd9ff1b2d602b092eb71269c440f55244ea62030fdf25

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

withmedia.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	withmedia.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	withmedia.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	withmedia.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	withmedia.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

withmedia.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	withmedia.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	withmedia.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	withmedia.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

withmedia.exe

pid	process
3172	withmedia.exe
3172	withmedia.exe
3172	withmedia.exe
3172	withmedia.exe
3172	withmedia.exe
3172	withmedia.exe
3172	withmedia.exe
3172	withmedia.exe
3172	withmedia.exe
3172	withmedia.exe
3172	withmedia.exe
3172	withmedia.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe

pid process

3432 af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe

pid	process
3432	af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exewithmedia.exe

description	pid	process	target process
PID 2700 wrote to memory of 3432	2700	af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe	af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe
PID 2700 wrote to memory of 3432	2700	af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe	af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe
PID 2700 wrote to memory of 3432	2700	af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe	af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe
PID 3048 wrote to memory of 3172	3048	withmedia.exe	withmedia.exe
PID 3048 wrote to memory of 3172	3048	withmedia.exe	withmedia.exe
PID 3048 wrote to memory of 3172	3048	withmedia.exe	withmedia.exe

C:\Users\Admin\AppData\Local\Temp\af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe
"C:\Users\Admin\AppData\Local\Temp\af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\af3cf3c8138b9829eeae5fd3dfacdc0f3f0f8dd434f0be82711228581f510784.exe
  --6516a9ef
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3432

C:\Windows\SysWOW64\withmedia.exe
"C:\Windows\SysWOW64\withmedia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\withmedia.exe
  --5da66cf4
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3172

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads