emotet | 5f2b3da7bab461edaba34cfabb710e8c504f4da95f18fc59afcf35f50250e489

General

Target

5f2b3da7bab461edaba34cfabb710e8c504f4da95f18fc59afcf35f50250e489.exe
Size

58KB
MD5

1f3845d95e6cf47aa5b6ad03333961ee
SHA1

60f07ac82822d3704a63fc556fe4388c2389d1c8
SHA256

5f2b3da7bab461edaba34cfabb710e8c504f4da95f18fc59afcf35f50250e489
SHA512

62ba59cd3435f457d7642bc11bc914dc983238893fa460819d8009a7fba08093a0c34cb89135e25c87b66fa551263a72881741732d075641051c1de322e842b4

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

footxcl.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	footxcl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 25 IoCs

Processes:

footxcl.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	footxcl.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f002d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	footxcl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{82F571E6-9FD9-4642-A125-321421E713F1}	footxcl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{82F571E6-9FD9-4642-A125-321421E713F1}\WpadNetworkName = "Network 3"	footxcl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-4d-f4-bd-3d-29\WpadDecision = "0"	footxcl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	footxcl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	footxcl.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	footxcl.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-4d-f4-bd-3d-29\WpadDecisionTime = 10588658e931d801	footxcl.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f002d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	footxcl.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{82F571E6-9FD9-4642-A125-321421E713F1}\WpadDecisionTime = d083e07be931d801	footxcl.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-4d-f4-bd-3d-29\WpadDecisionTime = d083e07be931d801	footxcl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	footxcl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	footxcl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	footxcl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{82F571E6-9FD9-4642-A125-321421E713F1}\WpadDecision = "0"	footxcl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-4d-f4-bd-3d-29	footxcl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-4d-f4-bd-3d-29\WpadDecisionReason = "1"	footxcl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-4d-f4-bd-3d-29\WpadDetectedUrl	footxcl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	footxcl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	footxcl.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{82F571E6-9FD9-4642-A125-321421E713F1}\WpadDecisionTime = 10588658e931d801	footxcl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	footxcl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{82F571E6-9FD9-4642-A125-321421E713F1}\WpadDecisionReason = "1"	footxcl.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{82F571E6-9FD9-4642-A125-321421E713F1}\4a-4d-f4-bd-3d-29	footxcl.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

footxcl.exe

pid process

1416 footxcl.exe
1416 footxcl.exe
1416 footxcl.exe
1416 footxcl.exe
1416 footxcl.exe
1416 footxcl.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

5f2b3da7bab461edaba34cfabb710e8c504f4da95f18fc59afcf35f50250e489.exe

pid process

1704 5f2b3da7bab461edaba34cfabb710e8c504f4da95f18fc59afcf35f50250e489.exe

pid	process
1416	footxcl.exe
1416	footxcl.exe
1416	footxcl.exe
1416	footxcl.exe
1416	footxcl.exe
1416	footxcl.exe

pid	process
1704	5f2b3da7bab461edaba34cfabb710e8c504f4da95f18fc59afcf35f50250e489.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

5f2b3da7bab461edaba34cfabb710e8c504f4da95f18fc59afcf35f50250e489.exefootxcl.exe

description	pid	process	target process
PID 1464 wrote to memory of 1704	1464	5f2b3da7bab461edaba34cfabb710e8c504f4da95f18fc59afcf35f50250e489.exe	5f2b3da7bab461edaba34cfabb710e8c504f4da95f18fc59afcf35f50250e489.exe
PID 1464 wrote to memory of 1704	1464	5f2b3da7bab461edaba34cfabb710e8c504f4da95f18fc59afcf35f50250e489.exe	5f2b3da7bab461edaba34cfabb710e8c504f4da95f18fc59afcf35f50250e489.exe
PID 1464 wrote to memory of 1704	1464	5f2b3da7bab461edaba34cfabb710e8c504f4da95f18fc59afcf35f50250e489.exe	5f2b3da7bab461edaba34cfabb710e8c504f4da95f18fc59afcf35f50250e489.exe
PID 1464 wrote to memory of 1704	1464	5f2b3da7bab461edaba34cfabb710e8c504f4da95f18fc59afcf35f50250e489.exe	5f2b3da7bab461edaba34cfabb710e8c504f4da95f18fc59afcf35f50250e489.exe
PID 1284 wrote to memory of 1416	1284	footxcl.exe	footxcl.exe
PID 1284 wrote to memory of 1416	1284	footxcl.exe	footxcl.exe
PID 1284 wrote to memory of 1416	1284	footxcl.exe	footxcl.exe
PID 1284 wrote to memory of 1416	1284	footxcl.exe	footxcl.exe

C:\Users\Admin\AppData\Local\Temp\5f2b3da7bab461edaba34cfabb710e8c504f4da95f18fc59afcf35f50250e489.exe
"C:\Users\Admin\AppData\Local\Temp\5f2b3da7bab461edaba34cfabb710e8c504f4da95f18fc59afcf35f50250e489.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Users\Admin\AppData\Local\Temp\5f2b3da7bab461edaba34cfabb710e8c504f4da95f18fc59afcf35f50250e489.exe
  --a41e7d22
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1704

C:\Windows\SysWOW64\footxcl.exe
"C:\Windows\SysWOW64\footxcl.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\SysWOW64\footxcl.exe
  --ec6e52a9
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-54-0x00000000752A1000-0x00000000752A3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads