emotet | 32f19e4ea4e9c4bd658f01425eed8255de8ac780e8d93321c266c002119b74b5

General

Target

32f19e4ea4e9c4bd658f01425eed8255de8ac780e8d93321c266c002119b74b5.exe
Size

179KB
MD5

b471f7f30035101de4ebbc9dfc96df89
SHA1

337bab71095ed70a2b5bd1e6f1f3e4d0e5e700c7
SHA256

32f19e4ea4e9c4bd658f01425eed8255de8ac780e8d93321c266c002119b74b5
SHA512

c27a2e760f6d4a2b9cac51c94bff77cd383c585a252ef464475bdd1b8ec6941db55337c1a6505c8559ac8fa06bfe70ba9e509df1e838b913a2b9bbbb0abd3b2a

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	menusadam.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	menusadam.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	menusadam.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	menusadam.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	menusadam.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	menusadam.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	menusadam.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
484	menusadam.exe
484	menusadam.exe
484	menusadam.exe
484	menusadam.exe
484	menusadam.exe
484	menusadam.exe
484	menusadam.exe
484	menusadam.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4716	32f19e4ea4e9c4bd658f01425eed8255de8ac780e8d93321c266c002119b74b5.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 4716	3572	32f19e4ea4e9c4bd658f01425eed8255de8ac780e8d93321c266c002119b74b5.exe	80
PID 3572 wrote to memory of 4716	3572	32f19e4ea4e9c4bd658f01425eed8255de8ac780e8d93321c266c002119b74b5.exe	80
PID 3572 wrote to memory of 4716	3572	32f19e4ea4e9c4bd658f01425eed8255de8ac780e8d93321c266c002119b74b5.exe	80
PID 992 wrote to memory of 484	992	menusadam.exe	83
PID 992 wrote to memory of 484	992	menusadam.exe	83
PID 992 wrote to memory of 484	992	menusadam.exe	83

C:\Users\Admin\AppData\Local\Temp\32f19e4ea4e9c4bd658f01425eed8255de8ac780e8d93321c266c002119b74b5.exe
"C:\Users\Admin\AppData\Local\Temp\32f19e4ea4e9c4bd658f01425eed8255de8ac780e8d93321c266c002119b74b5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Users\Admin\AppData\Local\Temp\32f19e4ea4e9c4bd658f01425eed8255de8ac780e8d93321c266c002119b74b5.exe
  --c63b1bee
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4716

C:\Windows\SysWOW64\menusadam.exe
"C:\Windows\SysWOW64\menusadam.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\SysWOW64\menusadam.exe
  --a9bf2339
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/484-139-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/484-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/992-136-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3572-130-0x00000000006C0000-0x00000000006DB000-memory.dmp

Filesize
108KB

Download
memory/3572-132-0x00000000006C0000-0x00000000006DB000-memory.dmp

Filesize
108KB

Download
memory/3572-133-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4716-134-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4716-135-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4716-138-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing