emotet | bbb17749e7d4493a06e557a500eefd2f3472439ca955d2b2f74367c431d39348

General

Target

bbb17749e7d4493a06e557a500eefd2f3472439ca955d2b2f74367c431d39348.exe
Size

74KB
MD5

0026837efde126f59238b7452d1a01c2
SHA1

1df151784fd01abbbcf0918f91634d2b89edf16f
SHA256

bbb17749e7d4493a06e557a500eefd2f3472439ca955d2b2f74367c431d39348
SHA512

ffb484eb3b4a1f029c6f7dcf0a19c475c871a282b49cde08c512a64878c597286405f27b9eb6c5ad677ec9155659f3979965c5be3594f50782524ab5b290757c

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	sitkahotspot.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	sitkahotspot.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	sitkahotspot.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	sitkahotspot.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E9C4CFF-38CF-4CC0-82C1-CEB64E9EE5C6}\WpadDecisionReason = "1"	sitkahotspot.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-30-60-70-ab-5a\WpadDecisionReason = "1"	sitkahotspot.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-30-60-70-ab-5a\WpadDecisionTime = a0cd68409088d801	sitkahotspot.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	sitkahotspot.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f008d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	sitkahotspot.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E9C4CFF-38CF-4CC0-82C1-CEB64E9EE5C6}	sitkahotspot.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E9C4CFF-38CF-4CC0-82C1-CEB64E9EE5C6}\WpadNetworkName = "Network 3"	sitkahotspot.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	sitkahotspot.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	sitkahotspot.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	sitkahotspot.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	sitkahotspot.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E9C4CFF-38CF-4CC0-82C1-CEB64E9EE5C6}\WpadDecision = "0"	sitkahotspot.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E9C4CFF-38CF-4CC0-82C1-CEB64E9EE5C6}\ea-30-60-70-ab-5a	sitkahotspot.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-30-60-70-ab-5a\WpadDecision = "0"	sitkahotspot.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	sitkahotspot.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	sitkahotspot.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E9C4CFF-38CF-4CC0-82C1-CEB64E9EE5C6}\WpadDecisionTime = a0cd68409088d801	sitkahotspot.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-30-60-70-ab-5a	sitkahotspot.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1356	sitkahotspot.exe
1356	sitkahotspot.exe
1356	sitkahotspot.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1748	bbb17749e7d4493a06e557a500eefd2f3472439ca955d2b2f74367c431d39348.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1748	536	bbb17749e7d4493a06e557a500eefd2f3472439ca955d2b2f74367c431d39348.exe	28
PID 536 wrote to memory of 1748	536	bbb17749e7d4493a06e557a500eefd2f3472439ca955d2b2f74367c431d39348.exe	28
PID 536 wrote to memory of 1748	536	bbb17749e7d4493a06e557a500eefd2f3472439ca955d2b2f74367c431d39348.exe	28
PID 536 wrote to memory of 1748	536	bbb17749e7d4493a06e557a500eefd2f3472439ca955d2b2f74367c431d39348.exe	28
PID 1144 wrote to memory of 1356	1144	sitkahotspot.exe	30
PID 1144 wrote to memory of 1356	1144	sitkahotspot.exe	30
PID 1144 wrote to memory of 1356	1144	sitkahotspot.exe	30
PID 1144 wrote to memory of 1356	1144	sitkahotspot.exe	30

C:\Users\Admin\AppData\Local\Temp\bbb17749e7d4493a06e557a500eefd2f3472439ca955d2b2f74367c431d39348.exe
"C:\Users\Admin\AppData\Local\Temp\bbb17749e7d4493a06e557a500eefd2f3472439ca955d2b2f74367c431d39348.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Users\Admin\AppData\Local\Temp\bbb17749e7d4493a06e557a500eefd2f3472439ca955d2b2f74367c431d39348.exe
  --3dda8493
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1748

C:\Windows\SysWOW64\sitkahotspot.exe
"C:\Windows\SysWOW64\sitkahotspot.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\SysWOW64\sitkahotspot.exe
  --1d5ccc4d
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1356

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-54-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/536-56-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1356-64-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1356-66-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1748-58-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1748-59-0x0000000075B61000-0x0000000075B63000-memory.dmp

Filesize
8KB

Download
memory/1748-62-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing