emotet | 35b4c199eeb258efd4378ff1d55822db57a828c5b81449b3bd8fef8d0b438570

General

Target

35b4c199eeb258efd4378ff1d55822db57a828c5b81449b3bd8fef8d0b438570.exe
Size

312KB
MD5

b0e9f839a6793a0e1023de9034c34d9e
SHA1

caa2afb556033c01a13286f4e6185424d96d245e
SHA256

35b4c199eeb258efd4378ff1d55822db57a828c5b81449b3bd8fef8d0b438570
SHA512

8d6a9e5384e01637cd76464c5471266de8b754e101d5ff52c4b411915e23b49485fd7b180f6aed97990d14d468d1c0d8889bd5e1b616c00e5525ffaf4acc7e9a

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3156	35b4c199eeb258efd4378ff1d55822db57a828c5b81449b3bd8fef8d0b438570.exe
3156	35b4c199eeb258efd4378ff1d55822db57a828c5b81449b3bd8fef8d0b438570.exe
2948	35b4c199eeb258efd4378ff1d55822db57a828c5b81449b3bd8fef8d0b438570.exe
2948	35b4c199eeb258efd4378ff1d55822db57a828c5b81449b3bd8fef8d0b438570.exe
2216	historycontrol.exe
2216	historycontrol.exe
2284	historycontrol.exe
2284	historycontrol.exe
5076	historycontrol.exe
5076	historycontrol.exe
5076	historycontrol.exe
5076	historycontrol.exe
5076	historycontrol.exe
5076	historycontrol.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2948	35b4c199eeb258efd4378ff1d55822db57a828c5b81449b3bd8fef8d0b438570.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 2948	3156	35b4c199eeb258efd4378ff1d55822db57a828c5b81449b3bd8fef8d0b438570.exe	80
PID 3156 wrote to memory of 2948	3156	35b4c199eeb258efd4378ff1d55822db57a828c5b81449b3bd8fef8d0b438570.exe	80
PID 3156 wrote to memory of 2948	3156	35b4c199eeb258efd4378ff1d55822db57a828c5b81449b3bd8fef8d0b438570.exe	80
PID 2216 wrote to memory of 2284	2216	historycontrol.exe	83
PID 2216 wrote to memory of 2284	2216	historycontrol.exe	83
PID 2216 wrote to memory of 2284	2216	historycontrol.exe	83
PID 2284 wrote to memory of 5076	2284	historycontrol.exe	84
PID 2284 wrote to memory of 5076	2284	historycontrol.exe	84
PID 2284 wrote to memory of 5076	2284	historycontrol.exe	84

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2216-141-0x00000000003C0000-0x0000000000422000-memory.dmp

Filesize
392KB

Download
memory/2216-144-0x00000000003C0000-0x0000000000422000-memory.dmp

Filesize
392KB

Download
memory/2284-150-0x00000000003C0000-0x0000000000422000-memory.dmp

Filesize
392KB

Download
memory/2284-147-0x00000000003C0000-0x0000000000422000-memory.dmp

Filesize
392KB

Download
memory/2948-136-0x00000000003C0000-0x0000000000422000-memory.dmp

Filesize
392KB

Download
memory/2948-139-0x00000000003C0000-0x0000000000422000-memory.dmp

Filesize
392KB

Download
memory/2948-138-0x00000000003C0000-0x0000000000422000-memory.dmp

Filesize
392KB

Download
memory/2948-145-0x00000000003C0000-0x0000000000422000-memory.dmp

Filesize
392KB

Download
memory/3156-131-0x00000000003C0000-0x0000000000422000-memory.dmp

Filesize
392KB

Download
memory/3156-134-0x00000000003C0000-0x0000000000422000-memory.dmp

Filesize
392KB

Download
memory/3156-130-0x00000000003C0000-0x00000000003D9000-memory.dmp

Filesize
100KB

Download
memory/5076-152-0x00000000003C0000-0x0000000000422000-memory.dmp

Filesize
392KB

Download
memory/5076-154-0x00000000003C0000-0x0000000000422000-memory.dmp

Filesize
392KB

Download
memory/5076-155-0x00000000003C0000-0x0000000000422000-memory.dmp

Filesize
392KB

Download