emotet | 414bb592b0111434f9c95e6e396af03803bfc38a5d55fda282142b7186724728

General

Target

414bb592b0111434f9c95e6e396af03803bfc38a5d55fda282142b7186724728.exe
Size

172KB
MD5

4d6ece858531b5b9040841db3419fd1c
SHA1

1ff0bb7169b26962457ed996c5a7aaf3f69aeee0
SHA256

414bb592b0111434f9c95e6e396af03803bfc38a5d55fda282142b7186724728
SHA512

5f4b3abd23f4572b842abd0c14ebb7fb7cdc2f5d288991fb7ea52ff415193a766567646d9b34529b16bbd5d4adc4d1f0b6847e9d8001a798ae1bc0e1c047075e

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

tsdtaupe.exe

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	tsdtaupe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 18 IoCs

Processes:

tsdtaupe.exe

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	tsdtaupe.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6D6029F8-E96C-44DF-8D85-CFA520C9AF43}\WpadDecision = "0"	tsdtaupe.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6D6029F8-E96C-44DF-8D85-CFA520C9AF43}\WpadNetworkName = "Network 3"	tsdtaupe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-3d-2f-73-16-36	tsdtaupe.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	tsdtaupe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	tsdtaupe.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-3d-2f-73-16-36\WpadDecision = "0"	tsdtaupe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	tsdtaupe.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-3d-2f-73-16-36\WpadDecisionReason = "1"	tsdtaupe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6D6029F8-E96C-44DF-8D85-CFA520C9AF43}\d2-3d-2f-73-16-36	tsdtaupe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	tsdtaupe.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	tsdtaupe.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	tsdtaupe.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0067000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	tsdtaupe.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6D6029F8-E96C-44DF-8D85-CFA520C9AF43}	tsdtaupe.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6D6029F8-E96C-44DF-8D85-CFA520C9AF43}\WpadDecisionReason = "1"	tsdtaupe.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6D6029F8-E96C-44DF-8D85-CFA520C9AF43}\WpadDecisionTime = c0e61d06d292d801	tsdtaupe.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-3d-2f-73-16-36\WpadDecisionTime = c0e61d06d292d801	tsdtaupe.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

414bb592b0111434f9c95e6e396af03803bfc38a5d55fda282142b7186724728.exe414bb592b0111434f9c95e6e396af03803bfc38a5d55fda282142b7186724728.exetsdtaupe.exetsdtaupe.exe

pid	Process
1400	414bb592b0111434f9c95e6e396af03803bfc38a5d55fda282142b7186724728.exe
556	414bb592b0111434f9c95e6e396af03803bfc38a5d55fda282142b7186724728.exe
1928	tsdtaupe.exe
1800	tsdtaupe.exe
1800	tsdtaupe.exe
1800	tsdtaupe.exe
1800	tsdtaupe.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

414bb592b0111434f9c95e6e396af03803bfc38a5d55fda282142b7186724728.exe

pid	Process
556	414bb592b0111434f9c95e6e396af03803bfc38a5d55fda282142b7186724728.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

414bb592b0111434f9c95e6e396af03803bfc38a5d55fda282142b7186724728.exetsdtaupe.exe

description	pid	Process	procid_target
PID 1400 wrote to memory of 556	1400	414bb592b0111434f9c95e6e396af03803bfc38a5d55fda282142b7186724728.exe	27
PID 1400 wrote to memory of 556	1400	414bb592b0111434f9c95e6e396af03803bfc38a5d55fda282142b7186724728.exe	27
PID 1400 wrote to memory of 556	1400	414bb592b0111434f9c95e6e396af03803bfc38a5d55fda282142b7186724728.exe	27
PID 1400 wrote to memory of 556	1400	414bb592b0111434f9c95e6e396af03803bfc38a5d55fda282142b7186724728.exe	27
PID 1928 wrote to memory of 1800	1928	tsdtaupe.exe	29
PID 1928 wrote to memory of 1800	1928	tsdtaupe.exe	29
PID 1928 wrote to memory of 1800	1928	tsdtaupe.exe	29
PID 1928 wrote to memory of 1800	1928	tsdtaupe.exe	29

C:\Users\Admin\AppData\Local\Temp\414bb592b0111434f9c95e6e396af03803bfc38a5d55fda282142b7186724728.exe
"C:\Users\Admin\AppData\Local\Temp\414bb592b0111434f9c95e6e396af03803bfc38a5d55fda282142b7186724728.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Users\Admin\AppData\Local\Temp\414bb592b0111434f9c95e6e396af03803bfc38a5d55fda282142b7186724728.exe
  "C:\Users\Admin\AppData\Local\Temp\414bb592b0111434f9c95e6e396af03803bfc38a5d55fda282142b7186724728.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  PID:556

C:\Windows\SysWOW64\tsdtaupe.exe
"C:\Windows\SysWOW64\tsdtaupe.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\tsdtaupe.exe
  "C:\Windows\SysWOW64\tsdtaupe.exe"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/556-69-0x0000000000270000-0x0000000000287000-memory.dmp

Filesize
92KB

Download
memory/556-62-0x0000000000290000-0x00000000002A7000-memory.dmp

Filesize
92KB

Download
memory/556-86-0x0000000000270000-0x0000000000287000-memory.dmp

Filesize
92KB

Download
memory/556-60-0x0000000000000000-mapping.dmp

Download
memory/556-70-0x00000000002B0000-0x00000000002D0000-memory.dmp

Filesize
128KB

Download
memory/556-66-0x0000000000290000-0x00000000002A7000-memory.dmp

Filesize
92KB

Download
memory/1400-67-0x00000000002A0000-0x00000000002B7000-memory.dmp

Filesize
92KB

Download
memory/1400-54-0x0000000075E41000-0x0000000075E43000-memory.dmp

Filesize
8KB

Download
memory/1400-59-0x00000000002C0000-0x00000000002D7000-memory.dmp

Filesize
92KB

Download
memory/1400-55-0x00000000002C0000-0x00000000002D7000-memory.dmp

Filesize
92KB

Download
memory/1400-68-0x00000000002E0000-0x0000000000300000-memory.dmp

Filesize
128KB

Download
memory/1800-89-0x00000000002F0000-0x0000000000307000-memory.dmp

Filesize
92KB

Download
memory/1800-77-0x0000000000000000-mapping.dmp

Download
memory/1800-79-0x0000000000420000-0x0000000000437000-memory.dmp

Filesize
92KB

Download
memory/1800-83-0x0000000000420000-0x0000000000437000-memory.dmp

Filesize
92KB

Download
memory/1800-88-0x0000000000890000-0x00000000008B0000-memory.dmp

Filesize
128KB

Download
memory/1800-87-0x00000000002F0000-0x0000000000307000-memory.dmp

Filesize
92KB

Download
memory/1928-72-0x00000000002B0000-0x00000000002C7000-memory.dmp

Filesize
92KB

Download
memory/1928-85-0x0000000000510000-0x0000000000530000-memory.dmp

Filesize
128KB

Download
memory/1928-84-0x0000000000290000-0x00000000002A7000-memory.dmp

Filesize
92KB

Download
memory/1928-76-0x00000000002B0000-0x00000000002C7000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads