emotet | 9fc295b4046b38f0020b30dab546c31d1b4464c0494ee8d1cbf0d6c7d58b35f3

General

Target

9fc295b4046b38f0020b30dab546c31d1b4464c0494ee8d1cbf0d6c7d58b35f3.exe
Size

59KB
MD5

7bb08b410ea79f92cbe93691e591126a
SHA1

fe847199a6b0b2dc6edff5b6044c767108755b40
SHA256

9fc295b4046b38f0020b30dab546c31d1b4464c0494ee8d1cbf0d6c7d58b35f3
SHA512

1a9027de68edcfc73d567b669720521c60f8a27a98c52053d24cd5e3ae982a3e43ac5d33c77617b1d78f92801c16694cc8ac2cebab12e8dab303bf27a29dca46

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

gatewaywan.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	gatewaywan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

gatewaywan.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{09109D97-FC8B-4E0D-96BD-87BF621CEDF8}\WpadDecisionReason = "1"	gatewaywan.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{09109D97-FC8B-4E0D-96BD-87BF621CEDF8}\WpadDecision = "0"	gatewaywan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{09109D97-FC8B-4E0D-96BD-87BF621CEDF8}\5a-8c-76-39-5f-2f	gatewaywan.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-8c-76-39-5f-2f\WpadDecisionReason = "1"	gatewaywan.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	gatewaywan.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	gatewaywan.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f002f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	gatewaywan.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{09109D97-FC8B-4E0D-96BD-87BF621CEDF8}\WpadNetworkName = "Network 3"	gatewaywan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-8c-76-39-5f-2f	gatewaywan.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-8c-76-39-5f-2f\WpadDecisionTime = 102a78367f31d801	gatewaywan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	gatewaywan.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	gatewaywan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	gatewaywan.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	gatewaywan.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{09109D97-FC8B-4E0D-96BD-87BF621CEDF8}	gatewaywan.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{09109D97-FC8B-4E0D-96BD-87BF621CEDF8}\WpadDecisionTime = 102a78367f31d801	gatewaywan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	gatewaywan.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	gatewaywan.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	gatewaywan.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	gatewaywan.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-8c-76-39-5f-2f\WpadDecision = "0"	gatewaywan.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

gatewaywan.exe

pid process

428 gatewaywan.exe
428 gatewaywan.exe
428 gatewaywan.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

9fc295b4046b38f0020b30dab546c31d1b4464c0494ee8d1cbf0d6c7d58b35f3.exe

pid process

1680 9fc295b4046b38f0020b30dab546c31d1b4464c0494ee8d1cbf0d6c7d58b35f3.exe

pid	process
428	gatewaywan.exe
428	gatewaywan.exe
428	gatewaywan.exe

pid	process
1680	9fc295b4046b38f0020b30dab546c31d1b4464c0494ee8d1cbf0d6c7d58b35f3.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

9fc295b4046b38f0020b30dab546c31d1b4464c0494ee8d1cbf0d6c7d58b35f3.exegatewaywan.exe

description	pid	process	target process
PID 1684 wrote to memory of 1680	1684	9fc295b4046b38f0020b30dab546c31d1b4464c0494ee8d1cbf0d6c7d58b35f3.exe	9fc295b4046b38f0020b30dab546c31d1b4464c0494ee8d1cbf0d6c7d58b35f3.exe
PID 1684 wrote to memory of 1680	1684	9fc295b4046b38f0020b30dab546c31d1b4464c0494ee8d1cbf0d6c7d58b35f3.exe	9fc295b4046b38f0020b30dab546c31d1b4464c0494ee8d1cbf0d6c7d58b35f3.exe
PID 1684 wrote to memory of 1680	1684	9fc295b4046b38f0020b30dab546c31d1b4464c0494ee8d1cbf0d6c7d58b35f3.exe	9fc295b4046b38f0020b30dab546c31d1b4464c0494ee8d1cbf0d6c7d58b35f3.exe
PID 1684 wrote to memory of 1680	1684	9fc295b4046b38f0020b30dab546c31d1b4464c0494ee8d1cbf0d6c7d58b35f3.exe	9fc295b4046b38f0020b30dab546c31d1b4464c0494ee8d1cbf0d6c7d58b35f3.exe
PID 1064 wrote to memory of 428	1064	gatewaywan.exe	gatewaywan.exe
PID 1064 wrote to memory of 428	1064	gatewaywan.exe	gatewaywan.exe
PID 1064 wrote to memory of 428	1064	gatewaywan.exe	gatewaywan.exe
PID 1064 wrote to memory of 428	1064	gatewaywan.exe	gatewaywan.exe

C:\Users\Admin\AppData\Local\Temp\9fc295b4046b38f0020b30dab546c31d1b4464c0494ee8d1cbf0d6c7d58b35f3.exe
"C:\Users\Admin\AppData\Local\Temp\9fc295b4046b38f0020b30dab546c31d1b4464c0494ee8d1cbf0d6c7d58b35f3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Users\Admin\AppData\Local\Temp\9fc295b4046b38f0020b30dab546c31d1b4464c0494ee8d1cbf0d6c7d58b35f3.exe
  --2ef02f5e
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1680

C:\Windows\SysWOW64\gatewaywan.exe
"C:\Windows\SysWOW64\gatewaywan.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\gatewaywan.exe
  --637d4f72
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1680-54-0x0000000076891000-0x0000000076893000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads