emotet | bbb17749e7d4493a06e557a500eefd2f3472439ca955d2b2f74367c431d39348

General

Target

bbb17749e7d4493a06e557a500eefd2f3472439ca955d2b2f74367c431d39348.exe
Size

74KB
MD5

0026837efde126f59238b7452d1a01c2
SHA1

1df151784fd01abbbcf0918f91634d2b89edf16f
SHA256

bbb17749e7d4493a06e557a500eefd2f3472439ca955d2b2f74367c431d39348
SHA512

ffb484eb3b4a1f029c6f7dcf0a19c475c871a282b49cde08c512a64878c597286405f27b9eb6c5ad677ec9155659f3979965c5be3594f50782524ab5b290757c

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	wrapsmall.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	wrapsmall.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	wrapsmall.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	wrapsmall.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	wrapsmall.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	wrapsmall.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	wrapsmall.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4756	wrapsmall.exe
4756	wrapsmall.exe
4756	wrapsmall.exe
4756	wrapsmall.exe
4756	wrapsmall.exe
4756	wrapsmall.exe
4756	wrapsmall.exe
4756	wrapsmall.exe
4756	wrapsmall.exe
4756	wrapsmall.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2752	bbb17749e7d4493a06e557a500eefd2f3472439ca955d2b2f74367c431d39348.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 2752	3768	bbb17749e7d4493a06e557a500eefd2f3472439ca955d2b2f74367c431d39348.exe	80
PID 3768 wrote to memory of 2752	3768	bbb17749e7d4493a06e557a500eefd2f3472439ca955d2b2f74367c431d39348.exe	80
PID 3768 wrote to memory of 2752	3768	bbb17749e7d4493a06e557a500eefd2f3472439ca955d2b2f74367c431d39348.exe	80
PID 2924 wrote to memory of 4756	2924	wrapsmall.exe	85
PID 2924 wrote to memory of 4756	2924	wrapsmall.exe	85
PID 2924 wrote to memory of 4756	2924	wrapsmall.exe	85

C:\Users\Admin\AppData\Local\Temp\bbb17749e7d4493a06e557a500eefd2f3472439ca955d2b2f74367c431d39348.exe
"C:\Users\Admin\AppData\Local\Temp\bbb17749e7d4493a06e557a500eefd2f3472439ca955d2b2f74367c431d39348.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Users\Admin\AppData\Local\Temp\bbb17749e7d4493a06e557a500eefd2f3472439ca955d2b2f74367c431d39348.exe
  --3dda8493
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2752

C:\Windows\SysWOW64\wrapsmall.exe
"C:\Windows\SysWOW64\wrapsmall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\wrapsmall.exe
  --7751d653
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2752-134-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2752-137-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3768-130-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3768-132-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4756-139-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4756-140-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing