emotet | 4c3c7c77dacd9a2233279a2091cb4165d845678e00be085b1c3aba22fafecfb3

General

Target

4c3c7c77dacd9a2233279a2091cb4165d845678e00be085b1c3aba22fafecfb3.exe
Size

413KB
MD5

f9178e2a50b57e49bc18bef516931380
SHA1

58dab44d83c6f1ad4407d77b88874e126b732688
SHA256

4c3c7c77dacd9a2233279a2091cb4165d845678e00be085b1c3aba22fafecfb3
SHA512

ac34c8342f06ca981ed5c549c32d9fae8996bd06d14b35d361072431b9480218e2f80aa7e997d659ed4e5d904f84432802f385c25e87c0159ee11781bd6aa7e5

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

4c3c7c77dacd9a2233279a2091cb4165d845678e00be085b1c3aba22fafecfb3.exe4c3c7c77dacd9a2233279a2091cb4165d845678e00be085b1c3aba22fafecfb3.exeiconsvoice.exeiconsvoice.exe

pid	process
4952	4c3c7c77dacd9a2233279a2091cb4165d845678e00be085b1c3aba22fafecfb3.exe
4952	4c3c7c77dacd9a2233279a2091cb4165d845678e00be085b1c3aba22fafecfb3.exe
864	4c3c7c77dacd9a2233279a2091cb4165d845678e00be085b1c3aba22fafecfb3.exe
864	4c3c7c77dacd9a2233279a2091cb4165d845678e00be085b1c3aba22fafecfb3.exe
384	iconsvoice.exe
384	iconsvoice.exe
2292	iconsvoice.exe
2292	iconsvoice.exe
2292	iconsvoice.exe
2292	iconsvoice.exe
2292	iconsvoice.exe
2292	iconsvoice.exe
2292	iconsvoice.exe
2292	iconsvoice.exe
2292	iconsvoice.exe
2292	iconsvoice.exe
2292	iconsvoice.exe
2292	iconsvoice.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

4c3c7c77dacd9a2233279a2091cb4165d845678e00be085b1c3aba22fafecfb3.exe

pid process

864 4c3c7c77dacd9a2233279a2091cb4165d845678e00be085b1c3aba22fafecfb3.exe

pid	process
864	4c3c7c77dacd9a2233279a2091cb4165d845678e00be085b1c3aba22fafecfb3.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

4c3c7c77dacd9a2233279a2091cb4165d845678e00be085b1c3aba22fafecfb3.exeiconsvoice.exe

description	pid	process	target process
PID 4952 wrote to memory of 864	4952	4c3c7c77dacd9a2233279a2091cb4165d845678e00be085b1c3aba22fafecfb3.exe	4c3c7c77dacd9a2233279a2091cb4165d845678e00be085b1c3aba22fafecfb3.exe
PID 4952 wrote to memory of 864	4952	4c3c7c77dacd9a2233279a2091cb4165d845678e00be085b1c3aba22fafecfb3.exe	4c3c7c77dacd9a2233279a2091cb4165d845678e00be085b1c3aba22fafecfb3.exe
PID 4952 wrote to memory of 864	4952	4c3c7c77dacd9a2233279a2091cb4165d845678e00be085b1c3aba22fafecfb3.exe	4c3c7c77dacd9a2233279a2091cb4165d845678e00be085b1c3aba22fafecfb3.exe
PID 384 wrote to memory of 2292	384	iconsvoice.exe	iconsvoice.exe
PID 384 wrote to memory of 2292	384	iconsvoice.exe	iconsvoice.exe
PID 384 wrote to memory of 2292	384	iconsvoice.exe	iconsvoice.exe

C:\Users\Admin\AppData\Local\Temp\4c3c7c77dacd9a2233279a2091cb4165d845678e00be085b1c3aba22fafecfb3.exe
"C:\Users\Admin\AppData\Local\Temp\4c3c7c77dacd9a2233279a2091cb4165d845678e00be085b1c3aba22fafecfb3.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Users\Admin\AppData\Local\Temp\4c3c7c77dacd9a2233279a2091cb4165d845678e00be085b1c3aba22fafecfb3.exe
  "C:\Users\Admin\AppData\Local\Temp\4c3c7c77dacd9a2233279a2091cb4165d845678e00be085b1c3aba22fafecfb3.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  PID:864

C:\Windows\SysWOW64\iconsvoice.exe
"C:\Windows\SysWOW64\iconsvoice.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:384
- C:\Windows\SysWOW64\iconsvoice.exe
  "C:\Windows\SysWOW64\iconsvoice.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/384-157-0x0000000000D50000-0x0000000000D66000-memory.dmp

Filesize
88KB

Download
memory/384-150-0x0000000000D70000-0x0000000000D86000-memory.dmp

Filesize
88KB

Download
memory/384-146-0x0000000000D70000-0x0000000000D86000-memory.dmp

Filesize
88KB

Download
memory/384-158-0x00000000005C0000-0x00000000005D0000-memory.dmp

Filesize
64KB

Download
memory/864-140-0x0000000000540000-0x0000000000556000-memory.dmp

Filesize
88KB

Download
memory/864-136-0x0000000000540000-0x0000000000556000-memory.dmp

Filesize
88KB

Download
memory/864-161-0x0000000000500000-0x0000000000516000-memory.dmp

Filesize
88KB

Download
memory/864-143-0x0000000000500000-0x0000000000516000-memory.dmp

Filesize
88KB

Download
memory/864-144-0x0000000000520000-0x0000000000530000-memory.dmp

Filesize
64KB

Download
memory/864-145-0x0000000000500000-0x0000000000516000-memory.dmp

Filesize
88KB

Download
memory/864-135-0x0000000000000000-mapping.dmp

Download
memory/2292-152-0x00000000005F0000-0x0000000000606000-memory.dmp

Filesize
88KB

Download
memory/2292-156-0x00000000005F0000-0x0000000000606000-memory.dmp

Filesize
88KB

Download
memory/2292-151-0x0000000000000000-mapping.dmp

Download
memory/2292-159-0x00000000005D0000-0x00000000005E6000-memory.dmp

Filesize
88KB

Download
memory/2292-160-0x0000000000610000-0x0000000000620000-memory.dmp

Filesize
64KB

Download
memory/2292-162-0x00000000005D0000-0x00000000005E6000-memory.dmp

Filesize
88KB

Download
memory/4952-134-0x0000000002200000-0x0000000002216000-memory.dmp

Filesize
88KB

Download
memory/4952-141-0x00000000021E0000-0x00000000021F6000-memory.dmp

Filesize
88KB

Download
memory/4952-130-0x0000000002200000-0x0000000002216000-memory.dmp

Filesize
88KB

Download
memory/4952-142-0x00000000021A0000-0x00000000021B0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing