emotet | ffbcf5e11564aa99ec6b8b6686fd02f9ef65ba1a5929e180d46b9bc3da3aa5dc

Analysis

Target

ffbcf5e11564aa99ec6b8b6686fd02f9ef65ba1a5929e180d46b9bc3da3aa5dc.exe
Size

81KB
MD5

71c50c8e9b397f5c411eef6a4bcfd95e
SHA1

d673dba48390fa8d87cb5cb0318aed397a0382d4
SHA256

ffbcf5e11564aa99ec6b8b6686fd02f9ef65ba1a5929e180d46b9bc3da3aa5dc
SHA512

7c265b82dbec012de0aa8aad45d2f6d09e51fd0f7614bb0cec6bf046ac3b84306acdab4c2257772629bd333781e94dc0663a5daff1377db5b5b91af7b8044623

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: RenamesItself 1 IoCs

Processes:

ffbcf5e11564aa99ec6b8b6686fd02f9ef65ba1a5929e180d46b9bc3da3aa5dc.exe

pid process

4968 ffbcf5e11564aa99ec6b8b6686fd02f9ef65ba1a5929e180d46b9bc3da3aa5dc.exe

pid	process
4968	ffbcf5e11564aa99ec6b8b6686fd02f9ef65ba1a5929e180d46b9bc3da3aa5dc.exe

C:\Users\Admin\AppData\Local\Temp\ffbcf5e11564aa99ec6b8b6686fd02f9ef65ba1a5929e180d46b9bc3da3aa5dc.exe
"C:\Users\Admin\AppData\Local\Temp\ffbcf5e11564aa99ec6b8b6686fd02f9ef65ba1a5929e180d46b9bc3da3aa5dc.exe"
1⤵
- Suspicious behavior: RenamesItself
PID:4968

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact