emotet | 411cc0e848e37589d5af9d8245f2c157ca00e0e0e51276aa43b4258612770eff

General

Target

411cc0e848e37589d5af9d8245f2c157ca00e0e0e51276aa43b4258612770eff.exe
Size

200KB
MD5

35a217cc26ef71d7e77df6ecc613a301
SHA1

fe741cdb83b427bfd68ea9e96149e6faabbb6d4c
SHA256

411cc0e848e37589d5af9d8245f2c157ca00e0e0e51276aa43b4258612770eff
SHA512

b9e9ac4535bb6f6ab9cab81df835a44355acac6461a2933ba1faa598abe9bbe4a086bd34b3e37ff270c34e5740223d43b0f3d57c95fff56b88da7958f8eb2bc5

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	cardsmspthrd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	cardsmspthrd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	cardsmspthrd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	cardsmspthrd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	cardsmspthrd.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	cardsmspthrd.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	cardsmspthrd.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4776	411cc0e848e37589d5af9d8245f2c157ca00e0e0e51276aa43b4258612770eff.exe
4776	411cc0e848e37589d5af9d8245f2c157ca00e0e0e51276aa43b4258612770eff.exe
3080	411cc0e848e37589d5af9d8245f2c157ca00e0e0e51276aa43b4258612770eff.exe
3080	411cc0e848e37589d5af9d8245f2c157ca00e0e0e51276aa43b4258612770eff.exe
1156	cardsmspthrd.exe
1156	cardsmspthrd.exe
1576	cardsmspthrd.exe
1576	cardsmspthrd.exe
1576	cardsmspthrd.exe
1576	cardsmspthrd.exe
1576	cardsmspthrd.exe
1576	cardsmspthrd.exe
1576	cardsmspthrd.exe
1576	cardsmspthrd.exe
1576	cardsmspthrd.exe
1576	cardsmspthrd.exe
1576	cardsmspthrd.exe
1576	cardsmspthrd.exe
1576	cardsmspthrd.exe
1576	cardsmspthrd.exe
1576	cardsmspthrd.exe
1576	cardsmspthrd.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3080	411cc0e848e37589d5af9d8245f2c157ca00e0e0e51276aa43b4258612770eff.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 3080	4776	411cc0e848e37589d5af9d8245f2c157ca00e0e0e51276aa43b4258612770eff.exe	80
PID 4776 wrote to memory of 3080	4776	411cc0e848e37589d5af9d8245f2c157ca00e0e0e51276aa43b4258612770eff.exe	80
PID 4776 wrote to memory of 3080	4776	411cc0e848e37589d5af9d8245f2c157ca00e0e0e51276aa43b4258612770eff.exe	80
PID 1156 wrote to memory of 1576	1156	cardsmspthrd.exe	82
PID 1156 wrote to memory of 1576	1156	cardsmspthrd.exe	82
PID 1156 wrote to memory of 1576	1156	cardsmspthrd.exe	82

C:\Users\Admin\AppData\Local\Temp\411cc0e848e37589d5af9d8245f2c157ca00e0e0e51276aa43b4258612770eff.exe
"C:\Users\Admin\AppData\Local\Temp\411cc0e848e37589d5af9d8245f2c157ca00e0e0e51276aa43b4258612770eff.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Users\Admin\AppData\Local\Temp\411cc0e848e37589d5af9d8245f2c157ca00e0e0e51276aa43b4258612770eff.exe
  "C:\Users\Admin\AppData\Local\Temp\411cc0e848e37589d5af9d8245f2c157ca00e0e0e51276aa43b4258612770eff.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  PID:3080

C:\Windows\SysWOW64\cardsmspthrd.exe
"C:\Windows\SysWOW64\cardsmspthrd.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\SysWOW64\cardsmspthrd.exe
  "C:\Windows\SysWOW64\cardsmspthrd.exe"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1156-145-0x00000000014D0000-0x00000000014DD000-memory.dmp

Filesize
52KB

Download
memory/1156-158-0x00000000014C0000-0x00000000014CD000-memory.dmp

Filesize
52KB

Download
memory/1156-151-0x00000000014E0000-0x0000000001500000-memory.dmp

Filesize
128KB

Download
memory/1156-150-0x00000000014C0000-0x00000000014CD000-memory.dmp

Filesize
52KB

Download
memory/1156-149-0x00000000014D0000-0x00000000014DD000-memory.dmp

Filesize
52KB

Download
memory/1576-157-0x0000000000760000-0x000000000076D000-memory.dmp

Filesize
52KB

Download
memory/1576-161-0x0000000000780000-0x00000000007A0000-memory.dmp

Filesize
128KB

Download
memory/1576-153-0x0000000000760000-0x000000000076D000-memory.dmp

Filesize
52KB

Download
memory/1576-160-0x0000000000750000-0x000000000075D000-memory.dmp

Filesize
52KB

Download
memory/3080-159-0x0000000000AA0000-0x0000000000AAD000-memory.dmp

Filesize
52KB

Download
memory/3080-143-0x0000000000AA0000-0x0000000000AAD000-memory.dmp

Filesize
52KB

Download
memory/3080-144-0x0000000000AC0000-0x0000000000AE0000-memory.dmp

Filesize
128KB

Download
memory/3080-140-0x0000000000AB0000-0x0000000000ABD000-memory.dmp

Filesize
52KB

Download
memory/3080-136-0x0000000000AB0000-0x0000000000ABD000-memory.dmp

Filesize
52KB

Download
memory/4776-141-0x0000000000740000-0x000000000074D000-memory.dmp

Filesize
52KB

Download
memory/4776-134-0x0000000000750000-0x000000000075D000-memory.dmp

Filesize
52KB

Download
memory/4776-130-0x0000000000750000-0x000000000075D000-memory.dmp

Filesize
52KB

Download
memory/4776-142-0x0000000000760000-0x0000000000780000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing