emotet | 1f3b5be93c06d5a8e5d94116294a1bd711d8688126765dfb7ee080c41f92fbb5

General

Target

1f3b5be93c06d5a8e5d94116294a1bd711d8688126765dfb7ee080c41f92fbb5.exe
Size

185KB
MD5

ba9ca1397990de73932f0d59a48cbe94
SHA1

ad4d08843c80b20b2b3e3832cc0bede20ac51095
SHA256

1f3b5be93c06d5a8e5d94116294a1bd711d8688126765dfb7ee080c41f92fbb5
SHA512

85e172e0706f3a47c4ea1f90df3abbaae4904299274fae1bad839f7b158ae2e7cb2abab6313b2771f1f8ed9173f352f1cd99289efec7bc9770834e6a39f1c9fe

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

targetssel.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	targetssel.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	targetssel.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	targetssel.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	targetssel.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

targetssel.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	targetssel.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	targetssel.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	targetssel.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

targetssel.exe

pid	process
912	targetssel.exe
912	targetssel.exe
912	targetssel.exe
912	targetssel.exe
912	targetssel.exe
912	targetssel.exe
912	targetssel.exe
912	targetssel.exe
912	targetssel.exe
912	targetssel.exe
912	targetssel.exe
912	targetssel.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

1f3b5be93c06d5a8e5d94116294a1bd711d8688126765dfb7ee080c41f92fbb5.exe

pid process

4160 1f3b5be93c06d5a8e5d94116294a1bd711d8688126765dfb7ee080c41f92fbb5.exe

pid	process
4160	1f3b5be93c06d5a8e5d94116294a1bd711d8688126765dfb7ee080c41f92fbb5.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1f3b5be93c06d5a8e5d94116294a1bd711d8688126765dfb7ee080c41f92fbb5.exetargetssel.exe

description	pid	process	target process
PID 1956 wrote to memory of 4160	1956	1f3b5be93c06d5a8e5d94116294a1bd711d8688126765dfb7ee080c41f92fbb5.exe	1f3b5be93c06d5a8e5d94116294a1bd711d8688126765dfb7ee080c41f92fbb5.exe
PID 1956 wrote to memory of 4160	1956	1f3b5be93c06d5a8e5d94116294a1bd711d8688126765dfb7ee080c41f92fbb5.exe	1f3b5be93c06d5a8e5d94116294a1bd711d8688126765dfb7ee080c41f92fbb5.exe
PID 1956 wrote to memory of 4160	1956	1f3b5be93c06d5a8e5d94116294a1bd711d8688126765dfb7ee080c41f92fbb5.exe	1f3b5be93c06d5a8e5d94116294a1bd711d8688126765dfb7ee080c41f92fbb5.exe
PID 464 wrote to memory of 912	464	targetssel.exe	targetssel.exe
PID 464 wrote to memory of 912	464	targetssel.exe	targetssel.exe
PID 464 wrote to memory of 912	464	targetssel.exe	targetssel.exe

C:\Users\Admin\AppData\Local\Temp\1f3b5be93c06d5a8e5d94116294a1bd711d8688126765dfb7ee080c41f92fbb5.exe
"C:\Users\Admin\AppData\Local\Temp\1f3b5be93c06d5a8e5d94116294a1bd711d8688126765dfb7ee080c41f92fbb5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Users\Admin\AppData\Local\Temp\1f3b5be93c06d5a8e5d94116294a1bd711d8688126765dfb7ee080c41f92fbb5.exe
--12d58de2
2⤵
- Suspicious behavior: RenamesItself
PID:4160

C:\Windows\SysWOW64\targetssel.exe
"C:\Windows\SysWOW64\targetssel.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:464

C:\Windows\SysWOW64\targetssel.exe
--bf8be34a
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:912

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/912-136-0x0000000000000000-mapping.dmp

Download
memory/912-138-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/912-139-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1956-130-0x0000000000590000-0x00000000005A1000-memory.dmp

Filesize
68KB

Download
memory/1956-131-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1956-133-0x0000000000590000-0x00000000005A1000-memory.dmp

Filesize
68KB

Download
memory/1956-134-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4160-132-0x0000000000000000-mapping.dmp

Download
memory/4160-135-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4160-137-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads