emotet | c7273b72d2db74efd63038480a185715677c84c902e30492b7905d48eabbc60e

General

Target

c7273b72d2db74efd63038480a185715677c84c902e30492b7905d48eabbc60e.exe
Size

133KB
MD5

adcb5d3a9688f4a1472aa43835cf1c80
SHA1

ec417f4f6462d7fdf40406c6a09e5a212177af6f
SHA256

c7273b72d2db74efd63038480a185715677c84c902e30492b7905d48eabbc60e
SHA512

c41c736f71c20991161a68ff8f980d2ed1d7d0c950b8baee4458af8e9acd3a106743e507ac150fa177802e3cd3843ec4b6c818092f802bdacd9a8e5714ae197c

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	startedavatar.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	startedavatar.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	startedavatar.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	startedavatar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	startedavatar.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	startedavatar.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	startedavatar.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4320	startedavatar.exe
4320	startedavatar.exe
4320	startedavatar.exe
4320	startedavatar.exe
4320	startedavatar.exe
4320	startedavatar.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2764	c7273b72d2db74efd63038480a185715677c84c902e30492b7905d48eabbc60e.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 2764	3416	c7273b72d2db74efd63038480a185715677c84c902e30492b7905d48eabbc60e.exe	79
PID 3416 wrote to memory of 2764	3416	c7273b72d2db74efd63038480a185715677c84c902e30492b7905d48eabbc60e.exe	79
PID 3416 wrote to memory of 2764	3416	c7273b72d2db74efd63038480a185715677c84c902e30492b7905d48eabbc60e.exe	79
PID 4608 wrote to memory of 4320	4608	startedavatar.exe	88
PID 4608 wrote to memory of 4320	4608	startedavatar.exe	88
PID 4608 wrote to memory of 4320	4608	startedavatar.exe	88

C:\Users\Admin\AppData\Local\Temp\c7273b72d2db74efd63038480a185715677c84c902e30492b7905d48eabbc60e.exe
"C:\Users\Admin\AppData\Local\Temp\c7273b72d2db74efd63038480a185715677c84c902e30492b7905d48eabbc60e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Users\Admin\AppData\Local\Temp\c7273b72d2db74efd63038480a185715677c84c902e30492b7905d48eabbc60e.exe
  --96a6ebf6
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2764

C:\Windows\SysWOW64\startedavatar.exe
"C:\Windows\SysWOW64\startedavatar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\SysWOW64\startedavatar.exe
  --2b031b50
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2764-133-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3416-130-0x00000000005C0000-0x00000000005DB000-memory.dmp

Filesize
108KB

Download
memory/3416-132-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4320-136-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4608-134-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing