emotet | 32f19e4ea4e9c4bd658f01425eed8255de8ac780e8d93321c266c002119b74b5

General

Target

32f19e4ea4e9c4bd658f01425eed8255de8ac780e8d93321c266c002119b74b5.exe
Size

179KB
MD5

b471f7f30035101de4ebbc9dfc96df89
SHA1

337bab71095ed70a2b5bd1e6f1f3e4d0e5e700c7
SHA256

32f19e4ea4e9c4bd658f01425eed8255de8ac780e8d93321c266c002119b74b5
SHA512

c27a2e760f6d4a2b9cac51c94bff77cd383c585a252ef464475bdd1b8ec6941db55337c1a6505c8559ac8fa06bfe70ba9e509df1e838b913a2b9bbbb0abd3b2a

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	enrollwordpad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	enrollwordpad.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{182A8FED-78F8-4C68-9723-D0561F63EF59}\WpadDecisionTime = e0897bac6e84d801	enrollwordpad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{182A8FED-78F8-4C68-9723-D0561F63EF59}\4a-10-00-4d-b1-fe	enrollwordpad.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	enrollwordpad.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	enrollwordpad.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	enrollwordpad.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	enrollwordpad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	enrollwordpad.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	enrollwordpad.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	enrollwordpad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	enrollwordpad.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{182A8FED-78F8-4C68-9723-D0561F63EF59}\WpadDecision = "0"	enrollwordpad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{182A8FED-78F8-4C68-9723-D0561F63EF59}	enrollwordpad.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{182A8FED-78F8-4C68-9723-D0561F63EF59}\WpadDecisionReason = "1"	enrollwordpad.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-10-00-4d-b1-fe\WpadDecisionTime = e0897bac6e84d801	enrollwordpad.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-10-00-4d-b1-fe\WpadDecision = "0"	enrollwordpad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	enrollwordpad.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	enrollwordpad.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{182A8FED-78F8-4C68-9723-D0561F63EF59}\WpadNetworkName = "Network 2"	enrollwordpad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-10-00-4d-b1-fe	enrollwordpad.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-10-00-4d-b1-fe\WpadDecisionReason = "1"	enrollwordpad.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1332	enrollwordpad.exe
1332	enrollwordpad.exe
1332	enrollwordpad.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1952	32f19e4ea4e9c4bd658f01425eed8255de8ac780e8d93321c266c002119b74b5.exe

Suspicious use of UnmapMainImage 4 IoCs

pid	Process
452	32f19e4ea4e9c4bd658f01425eed8255de8ac780e8d93321c266c002119b74b5.exe
1952	32f19e4ea4e9c4bd658f01425eed8255de8ac780e8d93321c266c002119b74b5.exe
1144	enrollwordpad.exe
1332	enrollwordpad.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 1952	452	32f19e4ea4e9c4bd658f01425eed8255de8ac780e8d93321c266c002119b74b5.exe	27
PID 452 wrote to memory of 1952	452	32f19e4ea4e9c4bd658f01425eed8255de8ac780e8d93321c266c002119b74b5.exe	27
PID 452 wrote to memory of 1952	452	32f19e4ea4e9c4bd658f01425eed8255de8ac780e8d93321c266c002119b74b5.exe	27
PID 452 wrote to memory of 1952	452	32f19e4ea4e9c4bd658f01425eed8255de8ac780e8d93321c266c002119b74b5.exe	27
PID 1144 wrote to memory of 1332	1144	enrollwordpad.exe	29
PID 1144 wrote to memory of 1332	1144	enrollwordpad.exe	29
PID 1144 wrote to memory of 1332	1144	enrollwordpad.exe	29
PID 1144 wrote to memory of 1332	1144	enrollwordpad.exe	29

C:\Users\Admin\AppData\Local\Temp\32f19e4ea4e9c4bd658f01425eed8255de8ac780e8d93321c266c002119b74b5.exe
"C:\Users\Admin\AppData\Local\Temp\32f19e4ea4e9c4bd658f01425eed8255de8ac780e8d93321c266c002119b74b5.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:452
- C:\Users\Admin\AppData\Local\Temp\32f19e4ea4e9c4bd658f01425eed8255de8ac780e8d93321c266c002119b74b5.exe
  --c63b1bee
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of UnmapMainImage
  PID:1952

C:\Windows\SysWOW64\enrollwordpad.exe
"C:\Windows\SysWOW64\enrollwordpad.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\SysWOW64\enrollwordpad.exe
  --5eacd3f9
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:1332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/452-54-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/452-56-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/452-57-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1332-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1332-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1952-58-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1952-59-0x0000000075381000-0x0000000075383000-memory.dmp

Filesize
8KB

Download
memory/1952-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1952-62-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing