emotet | 16a8fcc894ec3e48611e72a1b7442c4bd7a905e6a1c0497ad2cce10e88cddeb6

General

Target

16a8fcc894ec3e48611e72a1b7442c4bd7a905e6a1c0497ad2cce10e88cddeb6.exe
Size

233KB
MD5

99c2e398d26229870de9c24ddee37549
SHA1

ca8eb25d712925a4984c65e387321b2c2a1dc246
SHA256

16a8fcc894ec3e48611e72a1b7442c4bd7a905e6a1c0497ad2cce10e88cddeb6
SHA512

a5abf6786a9291335c114e325b478f143e01c86312c98b45e53bcb12692c0311da22e215be57d4a5f6757fb5f54be62eb8f71023a86d7a3680c3c9e3c0785f4f

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

satwab.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	satwab.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	satwab.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	satwab.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	satwab.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

satwab.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	satwab.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	satwab.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	satwab.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

satwab.exe

pid	process
4152	satwab.exe
4152	satwab.exe
4152	satwab.exe
4152	satwab.exe
4152	satwab.exe
4152	satwab.exe
4152	satwab.exe
4152	satwab.exe
4152	satwab.exe
4152	satwab.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

16a8fcc894ec3e48611e72a1b7442c4bd7a905e6a1c0497ad2cce10e88cddeb6.exe

pid process

3348 16a8fcc894ec3e48611e72a1b7442c4bd7a905e6a1c0497ad2cce10e88cddeb6.exe

pid	process
3348	16a8fcc894ec3e48611e72a1b7442c4bd7a905e6a1c0497ad2cce10e88cddeb6.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

16a8fcc894ec3e48611e72a1b7442c4bd7a905e6a1c0497ad2cce10e88cddeb6.exesatwab.exe

description	pid	process	target process
PID 5112 wrote to memory of 3348	5112	16a8fcc894ec3e48611e72a1b7442c4bd7a905e6a1c0497ad2cce10e88cddeb6.exe	16a8fcc894ec3e48611e72a1b7442c4bd7a905e6a1c0497ad2cce10e88cddeb6.exe
PID 5112 wrote to memory of 3348	5112	16a8fcc894ec3e48611e72a1b7442c4bd7a905e6a1c0497ad2cce10e88cddeb6.exe	16a8fcc894ec3e48611e72a1b7442c4bd7a905e6a1c0497ad2cce10e88cddeb6.exe
PID 5112 wrote to memory of 3348	5112	16a8fcc894ec3e48611e72a1b7442c4bd7a905e6a1c0497ad2cce10e88cddeb6.exe	16a8fcc894ec3e48611e72a1b7442c4bd7a905e6a1c0497ad2cce10e88cddeb6.exe
PID 1956 wrote to memory of 4152	1956	satwab.exe	satwab.exe
PID 1956 wrote to memory of 4152	1956	satwab.exe	satwab.exe
PID 1956 wrote to memory of 4152	1956	satwab.exe	satwab.exe

C:\Users\Admin\AppData\Local\Temp\16a8fcc894ec3e48611e72a1b7442c4bd7a905e6a1c0497ad2cce10e88cddeb6.exe
"C:\Users\Admin\AppData\Local\Temp\16a8fcc894ec3e48611e72a1b7442c4bd7a905e6a1c0497ad2cce10e88cddeb6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5112

C:\Users\Admin\AppData\Local\Temp\16a8fcc894ec3e48611e72a1b7442c4bd7a905e6a1c0497ad2cce10e88cddeb6.exe
--50089201
2⤵
- Suspicious behavior: RenamesItself
PID:3348

C:\Windows\SysWOW64\satwab.exe
"C:\Windows\SysWOW64\satwab.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\satwab.exe
--df64984
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4152

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3348-131-0x0000000000000000-mapping.dmp

Download
memory/3348-134-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3348-136-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4152-135-0x0000000000000000-mapping.dmp

Download
memory/4152-137-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4152-138-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5112-130-0x0000000002180000-0x000000000219B000-memory.dmp

Filesize
108KB

Download
memory/5112-132-0x0000000002180000-0x000000000219B000-memory.dmp

Filesize
108KB

Download
memory/5112-133-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads