emotet | 02b969c4d126d1b50d6e7092282064d3c3127a6c4b70b5420fe5ae8033b4a290

General

Target

02b969c4d126d1b50d6e7092282064d3c3127a6c4b70b5420fe5ae8033b4a290.exe
Size

518KB
MD5

8647fb1f37889c92cb70b6e82dac1cdd
SHA1

255ac2d361f3264c477ce1a476b864af45f5de51
SHA256

02b969c4d126d1b50d6e7092282064d3c3127a6c4b70b5420fe5ae8033b4a290
SHA512

e8a24a94dcf7a4e09e35125d4cebfbe329c87dbc668dea802812b37c98733b517fe52331a9729acfdae0829dae067631c31fa94a65073ca90f9dfae526d8a0c7

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

attribiwamreg.exe

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	attribiwamreg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 18 IoCs

Processes:

attribiwamreg.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	attribiwamreg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	attribiwamreg.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	attribiwamreg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-c2-5c-ed-f9-91\WpadDecisionReason = "1"	attribiwamreg.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	attribiwamreg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	attribiwamreg.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8B45D76-266A-4413-8BAE-9A69A1EE9635}	attribiwamreg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	attribiwamreg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8B45D76-266A-4413-8BAE-9A69A1EE9635}\WpadDecisionReason = "1"	attribiwamreg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8B45D76-266A-4413-8BAE-9A69A1EE9635}\WpadNetworkName = "Network 2"	attribiwamreg.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-c2-5c-ed-f9-91	attribiwamreg.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-c2-5c-ed-f9-91\WpadDecisionTime = 8070f5896672d801	attribiwamreg.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	attribiwamreg.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00ab000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	attribiwamreg.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8B45D76-266A-4413-8BAE-9A69A1EE9635}\WpadDecisionTime = 8070f5896672d801	attribiwamreg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8B45D76-266A-4413-8BAE-9A69A1EE9635}\WpadDecision = "0"	attribiwamreg.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8B45D76-266A-4413-8BAE-9A69A1EE9635}\02-c2-5c-ed-f9-91	attribiwamreg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-c2-5c-ed-f9-91\WpadDecision = "0"	attribiwamreg.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

02b969c4d126d1b50d6e7092282064d3c3127a6c4b70b5420fe5ae8033b4a290.exe02b969c4d126d1b50d6e7092282064d3c3127a6c4b70b5420fe5ae8033b4a290.exeattribiwamreg.exeattribiwamreg.exe

pid	Process
336	02b969c4d126d1b50d6e7092282064d3c3127a6c4b70b5420fe5ae8033b4a290.exe
1660	02b969c4d126d1b50d6e7092282064d3c3127a6c4b70b5420fe5ae8033b4a290.exe
948	attribiwamreg.exe
1164	attribiwamreg.exe
1164	attribiwamreg.exe
1164	attribiwamreg.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

02b969c4d126d1b50d6e7092282064d3c3127a6c4b70b5420fe5ae8033b4a290.exe

pid	Process
1660	02b969c4d126d1b50d6e7092282064d3c3127a6c4b70b5420fe5ae8033b4a290.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

02b969c4d126d1b50d6e7092282064d3c3127a6c4b70b5420fe5ae8033b4a290.exeattribiwamreg.exe

description	pid	Process	procid_target
PID 336 wrote to memory of 1660	336	02b969c4d126d1b50d6e7092282064d3c3127a6c4b70b5420fe5ae8033b4a290.exe	28
PID 336 wrote to memory of 1660	336	02b969c4d126d1b50d6e7092282064d3c3127a6c4b70b5420fe5ae8033b4a290.exe	28
PID 336 wrote to memory of 1660	336	02b969c4d126d1b50d6e7092282064d3c3127a6c4b70b5420fe5ae8033b4a290.exe	28
PID 336 wrote to memory of 1660	336	02b969c4d126d1b50d6e7092282064d3c3127a6c4b70b5420fe5ae8033b4a290.exe	28
PID 948 wrote to memory of 1164	948	attribiwamreg.exe	30
PID 948 wrote to memory of 1164	948	attribiwamreg.exe	30
PID 948 wrote to memory of 1164	948	attribiwamreg.exe	30
PID 948 wrote to memory of 1164	948	attribiwamreg.exe	30

C:\Users\Admin\AppData\Local\Temp\02b969c4d126d1b50d6e7092282064d3c3127a6c4b70b5420fe5ae8033b4a290.exe
"C:\Users\Admin\AppData\Local\Temp\02b969c4d126d1b50d6e7092282064d3c3127a6c4b70b5420fe5ae8033b4a290.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:336
- C:\Users\Admin\AppData\Local\Temp\02b969c4d126d1b50d6e7092282064d3c3127a6c4b70b5420fe5ae8033b4a290.exe
  "C:\Users\Admin\AppData\Local\Temp\02b969c4d126d1b50d6e7092282064d3c3127a6c4b70b5420fe5ae8033b4a290.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  PID:1660

C:\Windows\SysWOW64\attribiwamreg.exe
"C:\Windows\SysWOW64\attribiwamreg.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\attribiwamreg.exe
  "C:\Windows\SysWOW64\attribiwamreg.exe"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/336-54-0x0000000075781000-0x0000000075783000-memory.dmp

Filesize
8KB

Download
memory/336-55-0x0000000000290000-0x00000000002A7000-memory.dmp

Filesize
92KB

Download
memory/336-59-0x0000000000290000-0x00000000002A7000-memory.dmp

Filesize
92KB

Download
memory/336-68-0x0000000000200000-0x0000000000210000-memory.dmp

Filesize
64KB

Download
memory/336-67-0x00000000001E0000-0x00000000001F7000-memory.dmp

Filesize
92KB

Download
memory/948-86-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/948-85-0x0000000000250000-0x0000000000267000-memory.dmp

Filesize
92KB

Download
memory/948-73-0x00000000003C0000-0x00000000003D7000-memory.dmp

Filesize
92KB

Download
memory/948-77-0x00000000003C0000-0x00000000003D7000-memory.dmp

Filesize
92KB

Download
memory/1164-89-0x0000000000360000-0x0000000000370000-memory.dmp

Filesize
64KB

Download
memory/1164-90-0x0000000000320000-0x0000000000337000-memory.dmp

Filesize
92KB

Download
memory/1164-88-0x0000000000320000-0x0000000000337000-memory.dmp

Filesize
92KB

Download
memory/1164-84-0x0000000000340000-0x0000000000357000-memory.dmp

Filesize
92KB

Download
memory/1164-78-0x0000000000000000-mapping.dmp

Download
memory/1164-80-0x0000000000340000-0x0000000000357000-memory.dmp

Filesize
92KB

Download
memory/1660-66-0x0000000000300000-0x0000000000317000-memory.dmp

Filesize
92KB

Download
memory/1660-71-0x00000000002E0000-0x00000000002F7000-memory.dmp

Filesize
92KB

Download
memory/1660-70-0x0000000000250000-0x0000000000260000-memory.dmp

Filesize
64KB

Download
memory/1660-87-0x00000000002E0000-0x00000000002F7000-memory.dmp

Filesize
92KB

Download
memory/1660-69-0x00000000002E0000-0x00000000002F7000-memory.dmp

Filesize
92KB

Download
memory/1660-62-0x0000000000300000-0x0000000000317000-memory.dmp

Filesize
92KB

Download
memory/1660-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads