emotet | 1b6aa692ba88e13ddec659e9c601d305146fba99e16181467cdfe49c7b109918

Analysis

Target

1b6aa692ba88e13ddec659e9c601d305146fba99e16181467cdfe49c7b109918.exe
Size

379KB
MD5

4042f9b434b667cc9ba1c96715a1a79e
SHA1

d784d12a497447a266cbaa1bf3807df5b14d640c
SHA256

1b6aa692ba88e13ddec659e9c601d305146fba99e16181467cdfe49c7b109918
SHA512

c1243c2d46f066d94d3fb4a9a0e5c2aafe4abc5593eeb4d16a1e342044b4d20ebb93a185f588f49849c9a51a44368e438e16c49d63d0d182a4bcaecb4d3e16ab

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: RenamesItself 1 IoCs

Processes:

1b6aa692ba88e13ddec659e9c601d305146fba99e16181467cdfe49c7b109918.exe

pid process

956 1b6aa692ba88e13ddec659e9c601d305146fba99e16181467cdfe49c7b109918.exe

pid	process
956	1b6aa692ba88e13ddec659e9c601d305146fba99e16181467cdfe49c7b109918.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1b6aa692ba88e13ddec659e9c601d305146fba99e16181467cdfe49c7b109918.exe

description	pid	process	target process
PID 1564 wrote to memory of 956	1564	1b6aa692ba88e13ddec659e9c601d305146fba99e16181467cdfe49c7b109918.exe	1b6aa692ba88e13ddec659e9c601d305146fba99e16181467cdfe49c7b109918.exe
PID 1564 wrote to memory of 956	1564	1b6aa692ba88e13ddec659e9c601d305146fba99e16181467cdfe49c7b109918.exe	1b6aa692ba88e13ddec659e9c601d305146fba99e16181467cdfe49c7b109918.exe
PID 1564 wrote to memory of 956	1564	1b6aa692ba88e13ddec659e9c601d305146fba99e16181467cdfe49c7b109918.exe	1b6aa692ba88e13ddec659e9c601d305146fba99e16181467cdfe49c7b109918.exe
PID 1564 wrote to memory of 956	1564	1b6aa692ba88e13ddec659e9c601d305146fba99e16181467cdfe49c7b109918.exe	1b6aa692ba88e13ddec659e9c601d305146fba99e16181467cdfe49c7b109918.exe

C:\Users\Admin\AppData\Local\Temp\1b6aa692ba88e13ddec659e9c601d305146fba99e16181467cdfe49c7b109918.exe
"C:\Users\Admin\AppData\Local\Temp\1b6aa692ba88e13ddec659e9c601d305146fba99e16181467cdfe49c7b109918.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Users\Admin\AppData\Local\Temp\1b6aa692ba88e13ddec659e9c601d305146fba99e16181467cdfe49c7b109918.exe
  --cd45514a
  2⤵
  - Suspicious behavior: RenamesItself
  PID:956

C:\Windows\SysWOW64\hotspotsel.exe
"C:\Windows\SysWOW64\hotspotsel.exe"
1⤵
PID:1156

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/956-56-0x0000000000000000-mapping.dmp

Download
memory/956-58-0x0000000000830000-0x0000000000893000-memory.dmp

Filesize
396KB

Download
memory/956-59-0x0000000075CD1000-0x0000000075CD3000-memory.dmp

Filesize
8KB

Download
memory/1564-54-0x0000000000830000-0x0000000000844000-memory.dmp

Filesize
80KB

Download
memory/1564-55-0x0000000000830000-0x0000000000893000-memory.dmp

Filesize
396KB

Download