emotet | 2ed804b62a00797d5451138a2f0c88fc48c4cbc7da4da7a73414c9ba4e6a12ec

General

Target

2ed804b62a00797d5451138a2f0c88fc48c4cbc7da4da7a73414c9ba4e6a12ec.exe
Size

350KB
MD5

61fd6d472d3c6402c1eb5b6d7c121c06
SHA1

01f1e8eaa2c869f307ce544c486dca031c9f69ef
SHA256

2ed804b62a00797d5451138a2f0c88fc48c4cbc7da4da7a73414c9ba4e6a12ec
SHA512

2121705c36bd049c14ad1c730429edff5fa1f0150bc129cb6eddf0f75871b6d507a580f12ee331626b0bada245e893fb1248ee6e1d1bfeeeb046c72b11214890

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

sbslanes.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	sbslanes.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 18 IoCs

Processes:

sbslanes.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	sbslanes.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0096000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	sbslanes.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-2d-3c-73-4e-8f	sbslanes.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-2d-3c-73-4e-8f\WpadDecisionTime = a0b0e52c1486d801	sbslanes.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	sbslanes.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	sbslanes.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	sbslanes.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CAAA66A9-043B-41BA-AD09-E1C42E7F51B6}	sbslanes.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CAAA66A9-043B-41BA-AD09-E1C42E7F51B6}\WpadDecisionReason = "1"	sbslanes.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CAAA66A9-043B-41BA-AD09-E1C42E7F51B6}\WpadDecision = "0"	sbslanes.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-2d-3c-73-4e-8f\WpadDecision = "0"	sbslanes.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	sbslanes.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	sbslanes.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CAAA66A9-043B-41BA-AD09-E1C42E7F51B6}\WpadDecisionTime = a0b0e52c1486d801	sbslanes.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CAAA66A9-043B-41BA-AD09-E1C42E7F51B6}\WpadNetworkName = "Network 2"	sbslanes.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	sbslanes.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CAAA66A9-043B-41BA-AD09-E1C42E7F51B6}\be-2d-3c-73-4e-8f	sbslanes.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-2d-3c-73-4e-8f\WpadDecisionReason = "1"	sbslanes.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

2ed804b62a00797d5451138a2f0c88fc48c4cbc7da4da7a73414c9ba4e6a12ec.exe2ed804b62a00797d5451138a2f0c88fc48c4cbc7da4da7a73414c9ba4e6a12ec.exesbslanes.exesbslanes.exe

pid	process
1444	2ed804b62a00797d5451138a2f0c88fc48c4cbc7da4da7a73414c9ba4e6a12ec.exe
808	2ed804b62a00797d5451138a2f0c88fc48c4cbc7da4da7a73414c9ba4e6a12ec.exe
276	sbslanes.exe
832	sbslanes.exe
832	sbslanes.exe
832	sbslanes.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

2ed804b62a00797d5451138a2f0c88fc48c4cbc7da4da7a73414c9ba4e6a12ec.exe

pid process

808 2ed804b62a00797d5451138a2f0c88fc48c4cbc7da4da7a73414c9ba4e6a12ec.exe

pid	process
808	2ed804b62a00797d5451138a2f0c88fc48c4cbc7da4da7a73414c9ba4e6a12ec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2ed804b62a00797d5451138a2f0c88fc48c4cbc7da4da7a73414c9ba4e6a12ec.exesbslanes.exe

description	pid	process	target process
PID 1444 wrote to memory of 808	1444	2ed804b62a00797d5451138a2f0c88fc48c4cbc7da4da7a73414c9ba4e6a12ec.exe	2ed804b62a00797d5451138a2f0c88fc48c4cbc7da4da7a73414c9ba4e6a12ec.exe
PID 1444 wrote to memory of 808	1444	2ed804b62a00797d5451138a2f0c88fc48c4cbc7da4da7a73414c9ba4e6a12ec.exe	2ed804b62a00797d5451138a2f0c88fc48c4cbc7da4da7a73414c9ba4e6a12ec.exe
PID 1444 wrote to memory of 808	1444	2ed804b62a00797d5451138a2f0c88fc48c4cbc7da4da7a73414c9ba4e6a12ec.exe	2ed804b62a00797d5451138a2f0c88fc48c4cbc7da4da7a73414c9ba4e6a12ec.exe
PID 1444 wrote to memory of 808	1444	2ed804b62a00797d5451138a2f0c88fc48c4cbc7da4da7a73414c9ba4e6a12ec.exe	2ed804b62a00797d5451138a2f0c88fc48c4cbc7da4da7a73414c9ba4e6a12ec.exe
PID 276 wrote to memory of 832	276	sbslanes.exe	sbslanes.exe
PID 276 wrote to memory of 832	276	sbslanes.exe	sbslanes.exe
PID 276 wrote to memory of 832	276	sbslanes.exe	sbslanes.exe
PID 276 wrote to memory of 832	276	sbslanes.exe	sbslanes.exe

C:\Users\Admin\AppData\Local\Temp\2ed804b62a00797d5451138a2f0c88fc48c4cbc7da4da7a73414c9ba4e6a12ec.exe
"C:\Users\Admin\AppData\Local\Temp\2ed804b62a00797d5451138a2f0c88fc48c4cbc7da4da7a73414c9ba4e6a12ec.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1444

C:\Users\Admin\AppData\Local\Temp\2ed804b62a00797d5451138a2f0c88fc48c4cbc7da4da7a73414c9ba4e6a12ec.exe
"C:\Users\Admin\AppData\Local\Temp\2ed804b62a00797d5451138a2f0c88fc48c4cbc7da4da7a73414c9ba4e6a12ec.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:808

C:\Windows\SysWOW64\sbslanes.exe
"C:\Windows\SysWOW64\sbslanes.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:276

C:\Windows\SysWOW64\sbslanes.exe
"C:\Windows\SysWOW64\sbslanes.exe"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:832

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/276-73-0x0000000000140000-0x0000000000157000-memory.dmp

Filesize
92KB

Download
memory/276-86-0x0000000000160000-0x0000000000170000-memory.dmp

Filesize
64KB

Download
memory/276-85-0x0000000000120000-0x0000000000137000-memory.dmp

Filesize
92KB

Download
memory/276-77-0x0000000000140000-0x0000000000157000-memory.dmp

Filesize
92KB

Download
memory/808-71-0x0000000000180000-0x0000000000197000-memory.dmp

Filesize
92KB

Download
memory/808-62-0x00000000001A0000-0x00000000001B7000-memory.dmp

Filesize
92KB

Download
memory/808-87-0x0000000000180000-0x0000000000197000-memory.dmp

Filesize
92KB

Download
memory/808-66-0x00000000001A0000-0x00000000001B7000-memory.dmp

Filesize
92KB

Download
memory/808-69-0x0000000000180000-0x0000000000197000-memory.dmp

Filesize
92KB

Download
memory/808-70-0x0000000000110000-0x0000000000120000-memory.dmp

Filesize
64KB

Download
memory/808-60-0x0000000000000000-mapping.dmp

Download
memory/832-78-0x0000000000000000-mapping.dmp

Download
memory/832-80-0x0000000000310000-0x0000000000327000-memory.dmp

Filesize
92KB

Download
memory/832-84-0x0000000000310000-0x0000000000327000-memory.dmp

Filesize
92KB

Download
memory/832-88-0x00000000002F0000-0x0000000000307000-memory.dmp

Filesize
92KB

Download
memory/832-89-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/832-90-0x00000000002F0000-0x0000000000307000-memory.dmp

Filesize
92KB

Download
memory/1444-54-0x0000000075DE1000-0x0000000075DE3000-memory.dmp

Filesize
8KB

Download
memory/1444-68-0x0000000000320000-0x0000000000330000-memory.dmp

Filesize
64KB

Download
memory/1444-59-0x0000000000300000-0x0000000000317000-memory.dmp

Filesize
92KB

Download
memory/1444-55-0x0000000000300000-0x0000000000317000-memory.dmp

Filesize
92KB

Download
memory/1444-67-0x00000000001E0000-0x00000000001F7000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads