emotet | 10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657

General

Target

10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe
Size

233KB
MD5

cae66c1f90423cc92b23a8021f5a71f5
SHA1

7da260e181390c59c7f2a509d4f4f763957481bd
SHA256

10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657
SHA512

5e5b2eb47c061c8ae474c565ce360e2d502134fce7c80dc4d363c40ce2324c429039f3fd6174d94cf0bc1924aa4ea1f9b5790eb0970bbf01c9e643309b7d9153

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

avatarvsc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	avatarvsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

avatarvsc.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5e-f3-ed-e6-2a-3b\WpadDecisionTime = 50eccb771c93d801	avatarvsc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	avatarvsc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	avatarvsc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{92367198-538B-41A6-941C-476704BA3403}\WpadDecisionTime = 50eccb771c93d801	avatarvsc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{92367198-538B-41A6-941C-476704BA3403}\WpadDecision = "0"	avatarvsc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5e-f3-ed-e6-2a-3b	avatarvsc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5e-f3-ed-e6-2a-3b\WpadDecision = "0"	avatarvsc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	avatarvsc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	avatarvsc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{92367198-538B-41A6-941C-476704BA3403}\WpadDecisionReason = "1"	avatarvsc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{92367198-538B-41A6-941C-476704BA3403}\WpadNetworkName = "Network 3"	avatarvsc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{92367198-538B-41A6-941C-476704BA3403}\5e-f3-ed-e6-2a-3b	avatarvsc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	avatarvsc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00a2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	avatarvsc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{92367198-538B-41A6-941C-476704BA3403}	avatarvsc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5e-f3-ed-e6-2a-3b\WpadDecisionReason = "1"	avatarvsc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	avatarvsc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	avatarvsc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	avatarvsc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	avatarvsc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	avatarvsc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

avatarvsc.exe

pid process

1280 avatarvsc.exe
1280 avatarvsc.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe

pid process

1676 10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe

pid	process
1280	avatarvsc.exe
1280	avatarvsc.exe

pid	process
1676	10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe

Suspicious use of UnmapMainImage 4 IoCs

Processes:

10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exeavatarvsc.exeavatarvsc.exe

pid	process
1748	10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe
1676	10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe
1648	avatarvsc.exe
1280	avatarvsc.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exeavatarvsc.exe

description	pid	process	target process
PID 1748 wrote to memory of 1676	1748	10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe	10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe
PID 1748 wrote to memory of 1676	1748	10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe	10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe
PID 1748 wrote to memory of 1676	1748	10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe	10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe
PID 1748 wrote to memory of 1676	1748	10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe	10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe
PID 1648 wrote to memory of 1280	1648	avatarvsc.exe	avatarvsc.exe
PID 1648 wrote to memory of 1280	1648	avatarvsc.exe	avatarvsc.exe
PID 1648 wrote to memory of 1280	1648	avatarvsc.exe	avatarvsc.exe
PID 1648 wrote to memory of 1280	1648	avatarvsc.exe	avatarvsc.exe

C:\Users\Admin\AppData\Local\Temp\10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe
"C:\Users\Admin\AppData\Local\Temp\10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1748

C:\Users\Admin\AppData\Local\Temp\10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe
--ed027736
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:1676

C:\Windows\SysWOW64\avatarvsc.exe
"C:\Windows\SysWOW64\avatarvsc.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\SysWOW64\avatarvsc.exe
--fe5eab23
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1280

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1280-59-0x0000000000000000-mapping.dmp

Download
memory/1280-61-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/1280-62-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1280-64-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1676-54-0x0000000000000000-mapping.dmp

Download
memory/1676-57-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1676-58-0x0000000075761000-0x0000000075763000-memory.dmp

Filesize
8KB

Download
memory/1676-60-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1748-55-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/1748-56-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads