emotet | c7273b72d2db74efd63038480a185715677c84c902e30492b7905d48eabbc60e

General

Target

c7273b72d2db74efd63038480a185715677c84c902e30492b7905d48eabbc60e.exe
Size

133KB
MD5

adcb5d3a9688f4a1472aa43835cf1c80
SHA1

ec417f4f6462d7fdf40406c6a09e5a212177af6f
SHA256

c7273b72d2db74efd63038480a185715677c84c902e30492b7905d48eabbc60e
SHA512

c41c736f71c20991161a68ff8f980d2ed1d7d0c950b8baee4458af8e9acd3a106743e507ac150fa177802e3cd3843ec4b6c818092f802bdacd9a8e5714ae197c

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	turnedpolic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F60A84D1-FC6C-40D9-9C92-8B2336A1CDCD}\WpadDecisionReason = "1"	turnedpolic.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-73-be-54-ef-75	turnedpolic.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	turnedpolic.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	turnedpolic.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	turnedpolic.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F60A84D1-FC6C-40D9-9C92-8B2336A1CDCD}\ca-73-be-54-ef-75	turnedpolic.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-73-be-54-ef-75\WpadDecision = "0"	turnedpolic.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	turnedpolic.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	turnedpolic.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f003a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	turnedpolic.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F60A84D1-FC6C-40D9-9C92-8B2336A1CDCD}	turnedpolic.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F60A84D1-FC6C-40D9-9C92-8B2336A1CDCD}\WpadDecision = "0"	turnedpolic.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F60A84D1-FC6C-40D9-9C92-8B2336A1CDCD}\WpadNetworkName = "Network 3"	turnedpolic.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-73-be-54-ef-75\WpadDecisionReason = "1"	turnedpolic.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-73-be-54-ef-75\WpadDecisionTime = d00247b45e3fd801	turnedpolic.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	turnedpolic.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	turnedpolic.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	turnedpolic.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F60A84D1-FC6C-40D9-9C92-8B2336A1CDCD}\WpadDecisionTime = d00247b45e3fd801	turnedpolic.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	turnedpolic.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	turnedpolic.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1980	turnedpolic.exe
1980	turnedpolic.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1584	c7273b72d2db74efd63038480a185715677c84c902e30492b7905d48eabbc60e.exe

Suspicious use of UnmapMainImage 4 IoCs

pid	Process
1520	c7273b72d2db74efd63038480a185715677c84c902e30492b7905d48eabbc60e.exe
1584	c7273b72d2db74efd63038480a185715677c84c902e30492b7905d48eabbc60e.exe
296	turnedpolic.exe
1980	turnedpolic.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1584	1520	c7273b72d2db74efd63038480a185715677c84c902e30492b7905d48eabbc60e.exe	27
PID 1520 wrote to memory of 1584	1520	c7273b72d2db74efd63038480a185715677c84c902e30492b7905d48eabbc60e.exe	27
PID 1520 wrote to memory of 1584	1520	c7273b72d2db74efd63038480a185715677c84c902e30492b7905d48eabbc60e.exe	27
PID 1520 wrote to memory of 1584	1520	c7273b72d2db74efd63038480a185715677c84c902e30492b7905d48eabbc60e.exe	27
PID 296 wrote to memory of 1980	296	turnedpolic.exe	31
PID 296 wrote to memory of 1980	296	turnedpolic.exe	31
PID 296 wrote to memory of 1980	296	turnedpolic.exe	31
PID 296 wrote to memory of 1980	296	turnedpolic.exe	31

C:\Users\Admin\AppData\Local\Temp\c7273b72d2db74efd63038480a185715677c84c902e30492b7905d48eabbc60e.exe
"C:\Users\Admin\AppData\Local\Temp\c7273b72d2db74efd63038480a185715677c84c902e30492b7905d48eabbc60e.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Users\Admin\AppData\Local\Temp\c7273b72d2db74efd63038480a185715677c84c902e30492b7905d48eabbc60e.exe
  --96a6ebf6
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of UnmapMainImage
  PID:1584

C:\Windows\SysWOW64\turnedpolic.exe
"C:\Windows\SysWOW64\turnedpolic.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:296
- C:\Windows\SysWOW64\turnedpolic.exe
  --d9d2a0e1
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:1980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1520-54-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/1520-56-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1584-57-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/1584-58-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1584-59-0x00000000755A1000-0x00000000755A3000-memory.dmp

Filesize
8KB

Download
memory/1980-61-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing