emotet | 10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657

General

Target

10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe
Size

233KB
MD5

cae66c1f90423cc92b23a8021f5a71f5
SHA1

7da260e181390c59c7f2a509d4f4f763957481bd
SHA256

10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657
SHA512

5e5b2eb47c061c8ae474c565ce360e2d502134fce7c80dc4d363c40ce2324c429039f3fd6174d94cf0bc1924aa4ea1f9b5790eb0970bbf01c9e643309b7d9153

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

tmpldasmrc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	tmpldasmrc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	tmpldasmrc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	tmpldasmrc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	tmpldasmrc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

tmpldasmrc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	tmpldasmrc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	tmpldasmrc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	tmpldasmrc.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

tmpldasmrc.exe

pid	process
2944	tmpldasmrc.exe
2944	tmpldasmrc.exe
2944	tmpldasmrc.exe
2944	tmpldasmrc.exe
2944	tmpldasmrc.exe
2944	tmpldasmrc.exe
2944	tmpldasmrc.exe
2944	tmpldasmrc.exe
2944	tmpldasmrc.exe
2944	tmpldasmrc.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe

pid process

2888 10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe

pid	process
2888	10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exetmpldasmrc.exe

description	pid	process	target process
PID 1736 wrote to memory of 2888	1736	10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe	10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe
PID 1736 wrote to memory of 2888	1736	10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe	10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe
PID 1736 wrote to memory of 2888	1736	10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe	10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe
PID 3472 wrote to memory of 2944	3472	tmpldasmrc.exe	tmpldasmrc.exe
PID 3472 wrote to memory of 2944	3472	tmpldasmrc.exe	tmpldasmrc.exe
PID 3472 wrote to memory of 2944	3472	tmpldasmrc.exe	tmpldasmrc.exe

C:\Users\Admin\AppData\Local\Temp\10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe
"C:\Users\Admin\AppData\Local\Temp\10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Users\Admin\AppData\Local\Temp\10f4f755f2ff3f4849a80339b0bb50489acc28af4be9de004a46741f66bc1657.exe
--ed027736
2⤵
- Suspicious behavior: RenamesItself
PID:2888

C:\Windows\SysWOW64\tmpldasmrc.exe
"C:\Windows\SysWOW64\tmpldasmrc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3472

C:\Windows\SysWOW64\tmpldasmrc.exe
--9862432f
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2944

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-130-0x0000000000690000-0x00000000006AB000-memory.dmp

Filesize
108KB

Download
memory/1736-132-0x0000000000690000-0x00000000006AB000-memory.dmp

Filesize
108KB

Download
memory/1736-133-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2888-131-0x0000000000000000-mapping.dmp

Download
memory/2888-134-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2888-136-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2944-135-0x0000000000000000-mapping.dmp

Download
memory/2944-137-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2944-138-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads