emotet | 215ad70e2d6fa1c7321bc7f9f84f8a593e2db3345f6f93e2ecb84b31ad566a6b

General

Target

215ad70e2d6fa1c7321bc7f9f84f8a593e2db3345f6f93e2ecb84b31ad566a6b.exe
Size

214KB
MD5

4bde039fefaeaec56e7537af88cb2750
SHA1

1a1e019a459ef6e025d8f92cc450d5b1c722c122
SHA256

215ad70e2d6fa1c7321bc7f9f84f8a593e2db3345f6f93e2ecb84b31ad566a6b
SHA512

fae751731dbc0b0d3327426246af74e4abfdec0104e7a946913643fd4637c3f042efb02890c287168d6e443245bdebe6c54c5377e46bcc92ace518bd29a9b694

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	tuipavatar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	tuipavatar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	tuipavatar.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-81-74-5b-8f-b2\WpadDecisionReason = "1"	tuipavatar.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-81-74-5b-8f-b2\WpadDecision = "0"	tuipavatar.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	tuipavatar.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	tuipavatar.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{54531134-0C73-4E79-9DFA-AFA1BCF209A0}\WpadDecisionReason = "1"	tuipavatar.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{54531134-0C73-4E79-9DFA-AFA1BCF209A0}\WpadDecisionTime = a0dfe227687ed801	tuipavatar.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{54531134-0C73-4E79-9DFA-AFA1BCF209A0}\WpadDecision = "0"	tuipavatar.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{54531134-0C73-4E79-9DFA-AFA1BCF209A0}\ca-81-74-5b-8f-b2	tuipavatar.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	tuipavatar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	tuipavatar.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{54531134-0C73-4E79-9DFA-AFA1BCF209A0}	tuipavatar.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-81-74-5b-8f-b2\WpadDecisionTime = a0dfe227687ed801	tuipavatar.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	tuipavatar.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0082000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	tuipavatar.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{54531134-0C73-4E79-9DFA-AFA1BCF209A0}\WpadNetworkName = "Network 3"	tuipavatar.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-81-74-5b-8f-b2	tuipavatar.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1504	215ad70e2d6fa1c7321bc7f9f84f8a593e2db3345f6f93e2ecb84b31ad566a6b.exe
2020	215ad70e2d6fa1c7321bc7f9f84f8a593e2db3345f6f93e2ecb84b31ad566a6b.exe
2004	tuipavatar.exe
1952	tuipavatar.exe
1952	tuipavatar.exe
1952	tuipavatar.exe
1952	tuipavatar.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2020	215ad70e2d6fa1c7321bc7f9f84f8a593e2db3345f6f93e2ecb84b31ad566a6b.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 2020	1504	215ad70e2d6fa1c7321bc7f9f84f8a593e2db3345f6f93e2ecb84b31ad566a6b.exe	27
PID 1504 wrote to memory of 2020	1504	215ad70e2d6fa1c7321bc7f9f84f8a593e2db3345f6f93e2ecb84b31ad566a6b.exe	27
PID 1504 wrote to memory of 2020	1504	215ad70e2d6fa1c7321bc7f9f84f8a593e2db3345f6f93e2ecb84b31ad566a6b.exe	27
PID 1504 wrote to memory of 2020	1504	215ad70e2d6fa1c7321bc7f9f84f8a593e2db3345f6f93e2ecb84b31ad566a6b.exe	27
PID 2004 wrote to memory of 1952	2004	tuipavatar.exe	29
PID 2004 wrote to memory of 1952	2004	tuipavatar.exe	29
PID 2004 wrote to memory of 1952	2004	tuipavatar.exe	29
PID 2004 wrote to memory of 1952	2004	tuipavatar.exe	29

C:\Users\Admin\AppData\Local\Temp\215ad70e2d6fa1c7321bc7f9f84f8a593e2db3345f6f93e2ecb84b31ad566a6b.exe
"C:\Users\Admin\AppData\Local\Temp\215ad70e2d6fa1c7321bc7f9f84f8a593e2db3345f6f93e2ecb84b31ad566a6b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\AppData\Local\Temp\215ad70e2d6fa1c7321bc7f9f84f8a593e2db3345f6f93e2ecb84b31ad566a6b.exe
  "C:\Users\Admin\AppData\Local\Temp\215ad70e2d6fa1c7321bc7f9f84f8a593e2db3345f6f93e2ecb84b31ad566a6b.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  PID:2020

C:\Windows\SysWOW64\tuipavatar.exe
"C:\Windows\SysWOW64\tuipavatar.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\tuipavatar.exe
  "C:\Windows\SysWOW64\tuipavatar.exe"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1504-54-0x0000000000420000-0x000000000043A000-memory.dmp

Filesize
104KB

Download
memory/1504-58-0x0000000000420000-0x000000000043A000-memory.dmp

Filesize
104KB

Download
memory/1504-65-0x0000000000300000-0x000000000031A000-memory.dmp

Filesize
104KB

Download
memory/1504-66-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/1952-87-0x00000000000F0000-0x000000000010A000-memory.dmp

Filesize
104KB

Download
memory/1952-85-0x0000000000270000-0x0000000000280000-memory.dmp

Filesize
64KB

Download
memory/1952-84-0x00000000000F0000-0x000000000010A000-memory.dmp

Filesize
104KB

Download
memory/1952-80-0x0000000000210000-0x000000000022A000-memory.dmp

Filesize
104KB

Download
memory/1952-76-0x0000000000210000-0x000000000022A000-memory.dmp

Filesize
104KB

Download
memory/2004-70-0x0000000000420000-0x000000000043A000-memory.dmp

Filesize
104KB

Download
memory/2004-74-0x0000000000420000-0x000000000043A000-memory.dmp

Filesize
104KB

Download
memory/2004-81-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2004-82-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/2020-69-0x0000000075271000-0x0000000075273000-memory.dmp

Filesize
8KB

Download
memory/2020-68-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/2020-67-0x0000000000160000-0x000000000017A000-memory.dmp

Filesize
104KB

Download
memory/2020-83-0x0000000000160000-0x000000000017A000-memory.dmp

Filesize
104KB

Download
memory/2020-64-0x0000000000290000-0x00000000002AA000-memory.dmp

Filesize
104KB

Download
memory/2020-60-0x0000000000290000-0x00000000002AA000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing