emotet | 017a38c8b1ea67cc72ade902f1c5551a785f5c5a1f515fb43b5e7d2109225cb5

General

Target

017a38c8b1ea67cc72ade902f1c5551a785f5c5a1f515fb43b5e7d2109225cb5.exe
Size

148KB
MD5

7893d57cd60b412ef68220ce395f9a59
SHA1

a20fd845d6569d26ffcbc4a1c9c9aae51f7ffb85
SHA256

017a38c8b1ea67cc72ade902f1c5551a785f5c5a1f515fb43b5e7d2109225cb5
SHA512

14fd790842e5cc420bba09bf08fe0732b1c0d145b696515f3e43535f55f8ff3aa49a3ce7d04af245a62b8d2e023f3ea2a4a04a997f3eafec3386b4f861249a61

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	shimsstatus.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	shimsstatus.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A1E44E27-A1CE-4157-840E-EAE295251791}\WpadDecisionTime = d0c81cddec6ed801	shimsstatus.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-bb-b8-e8-42-f8\WpadDecision = "0"	shimsstatus.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	shimsstatus.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	shimsstatus.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	shimsstatus.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A1E44E27-A1CE-4157-840E-EAE295251791}\WpadNetworkName = "Network 3"	shimsstatus.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00b3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	shimsstatus.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A1E44E27-A1CE-4157-840E-EAE295251791}\WpadDecisionReason = "1"	shimsstatus.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-bb-b8-e8-42-f8\WpadDecisionReason = "1"	shimsstatus.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	shimsstatus.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	shimsstatus.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A1E44E27-A1CE-4157-840E-EAE295251791}\WpadDecision = "0"	shimsstatus.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-bb-b8-e8-42-f8	shimsstatus.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A1E44E27-A1CE-4157-840E-EAE295251791}\b2-bb-b8-e8-42-f8	shimsstatus.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-bb-b8-e8-42-f8\WpadDecisionTime = d0c81cddec6ed801	shimsstatus.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	shimsstatus.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A1E44E27-A1CE-4157-840E-EAE295251791}	shimsstatus.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
748	017a38c8b1ea67cc72ade902f1c5551a785f5c5a1f515fb43b5e7d2109225cb5.exe
1372	017a38c8b1ea67cc72ade902f1c5551a785f5c5a1f515fb43b5e7d2109225cb5.exe
2036	shimsstatus.exe
2024	shimsstatus.exe
2024	shimsstatus.exe
2024	shimsstatus.exe
2024	shimsstatus.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1372	017a38c8b1ea67cc72ade902f1c5551a785f5c5a1f515fb43b5e7d2109225cb5.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 1372	748	017a38c8b1ea67cc72ade902f1c5551a785f5c5a1f515fb43b5e7d2109225cb5.exe	15
PID 748 wrote to memory of 1372	748	017a38c8b1ea67cc72ade902f1c5551a785f5c5a1f515fb43b5e7d2109225cb5.exe	15
PID 748 wrote to memory of 1372	748	017a38c8b1ea67cc72ade902f1c5551a785f5c5a1f515fb43b5e7d2109225cb5.exe	15
PID 748 wrote to memory of 1372	748	017a38c8b1ea67cc72ade902f1c5551a785f5c5a1f515fb43b5e7d2109225cb5.exe	15
PID 2036 wrote to memory of 2024	2036	shimsstatus.exe	30
PID 2036 wrote to memory of 2024	2036	shimsstatus.exe	30
PID 2036 wrote to memory of 2024	2036	shimsstatus.exe	30
PID 2036 wrote to memory of 2024	2036	shimsstatus.exe	30

C:\Users\Admin\AppData\Local\Temp\017a38c8b1ea67cc72ade902f1c5551a785f5c5a1f515fb43b5e7d2109225cb5.exe
"C:\Users\Admin\AppData\Local\Temp\017a38c8b1ea67cc72ade902f1c5551a785f5c5a1f515fb43b5e7d2109225cb5.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:748
- C:\Users\Admin\AppData\Local\Temp\017a38c8b1ea67cc72ade902f1c5551a785f5c5a1f515fb43b5e7d2109225cb5.exe
  "C:\Users\Admin\AppData\Local\Temp\017a38c8b1ea67cc72ade902f1c5551a785f5c5a1f515fb43b5e7d2109225cb5.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  PID:1372

C:\Windows\SysWOW64\shimsstatus.exe
"C:\Windows\SysWOW64\shimsstatus.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\shimsstatus.exe
  "C:\Windows\SysWOW64\shimsstatus.exe"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-54-0x00000000003D0000-0x00000000003E9000-memory.dmp

Filesize
100KB

Download
memory/748-63-0x00000000003B0000-0x00000000003C9000-memory.dmp

Filesize
100KB

Download
memory/748-64-0x0000000000430000-0x0000000000448000-memory.dmp

Filesize
96KB

Download
memory/1372-66-0x0000000000430000-0x0000000000448000-memory.dmp

Filesize
96KB

Download
memory/1372-65-0x00000000003A0000-0x00000000003B9000-memory.dmp

Filesize
100KB

Download
memory/1372-59-0x00000000003C0000-0x00000000003D9000-memory.dmp

Filesize
100KB

Download
memory/1372-67-0x00000000763E1000-0x00000000763E3000-memory.dmp

Filesize
8KB

Download
memory/2024-73-0x00000000003D0000-0x00000000003E9000-memory.dmp

Filesize
100KB

Download
memory/2024-80-0x0000000000920000-0x0000000000938000-memory.dmp

Filesize
96KB

Download
memory/2024-79-0x0000000000320000-0x0000000000339000-memory.dmp

Filesize
100KB

Download
memory/2036-78-0x00000000002A0000-0x00000000002B8000-memory.dmp

Filesize
96KB

Download
memory/2036-77-0x00000000001E0000-0x00000000001F9000-memory.dmp

Filesize
100KB

Download
memory/2036-68-0x0000000000280000-0x0000000000299000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing