emotet | 50503f7e01611abca4ecbf80c098b35aeb038ace47be1605b0392910e71976ab

General

Target

50503f7e01611abca4ecbf80c098b35aeb038ace47be1605b0392910e71976ab.exe
Size

912KB
MD5

c78e9c3e594be30a54f437e58cedfc59
SHA1

d16d18cdd974899c654fce95dd3427299e737735
SHA256

50503f7e01611abca4ecbf80c098b35aeb038ace47be1605b0392910e71976ab
SHA512

d96cdfcffe84aaa9128225149ad5961477b2c10407ec885126dcb3ca340955b8b4dbd6a9e5c72f0453242bfcb504993fa013e90daca8233c8a0ac335e1f5fca3

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	waniwamreg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	waniwamreg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	waniwamreg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{09198BD8-AAE4-4499-87F6-CDDADBEAFAA8}\WpadDecisionReason = "1"	waniwamreg.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-b3-e2-21-6b-68\WpadDecisionTime = d01377d2399bd801	waniwamreg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-b3-e2-21-6b-68\WpadDecision = "0"	waniwamreg.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{09198BD8-AAE4-4499-87F6-CDDADBEAFAA8}\06-b3-e2-21-6b-68	waniwamreg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-b3-e2-21-6b-68\WpadDecisionReason = "1"	waniwamreg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	waniwamreg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	waniwamreg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	waniwamreg.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00b7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	waniwamreg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{09198BD8-AAE4-4499-87F6-CDDADBEAFAA8}\WpadNetworkName = "Network 3"	waniwamreg.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	waniwamreg.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	waniwamreg.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{09198BD8-AAE4-4499-87F6-CDDADBEAFAA8}	waniwamreg.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{09198BD8-AAE4-4499-87F6-CDDADBEAFAA8}\WpadDecisionTime = d01377d2399bd801	waniwamreg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{09198BD8-AAE4-4499-87F6-CDDADBEAFAA8}\WpadDecision = "0"	waniwamreg.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-b3-e2-21-6b-68	waniwamreg.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1392	50503f7e01611abca4ecbf80c098b35aeb038ace47be1605b0392910e71976ab.exe
1272	50503f7e01611abca4ecbf80c098b35aeb038ace47be1605b0392910e71976ab.exe
1500	waniwamreg.exe
520	waniwamreg.exe
520	waniwamreg.exe
520	waniwamreg.exe
520	waniwamreg.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1272	50503f7e01611abca4ecbf80c098b35aeb038ace47be1605b0392910e71976ab.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 1272	1392	50503f7e01611abca4ecbf80c098b35aeb038ace47be1605b0392910e71976ab.exe	27
PID 1392 wrote to memory of 1272	1392	50503f7e01611abca4ecbf80c098b35aeb038ace47be1605b0392910e71976ab.exe	27
PID 1392 wrote to memory of 1272	1392	50503f7e01611abca4ecbf80c098b35aeb038ace47be1605b0392910e71976ab.exe	27
PID 1392 wrote to memory of 1272	1392	50503f7e01611abca4ecbf80c098b35aeb038ace47be1605b0392910e71976ab.exe	27
PID 1500 wrote to memory of 520	1500	waniwamreg.exe	29
PID 1500 wrote to memory of 520	1500	waniwamreg.exe	29
PID 1500 wrote to memory of 520	1500	waniwamreg.exe	29
PID 1500 wrote to memory of 520	1500	waniwamreg.exe	29

C:\Users\Admin\AppData\Local\Temp\50503f7e01611abca4ecbf80c098b35aeb038ace47be1605b0392910e71976ab.exe
"C:\Users\Admin\AppData\Local\Temp\50503f7e01611abca4ecbf80c098b35aeb038ace47be1605b0392910e71976ab.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Users\Admin\AppData\Local\Temp\50503f7e01611abca4ecbf80c098b35aeb038ace47be1605b0392910e71976ab.exe
  "C:\Users\Admin\AppData\Local\Temp\50503f7e01611abca4ecbf80c098b35aeb038ace47be1605b0392910e71976ab.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  PID:1272

C:\Windows\SysWOW64\waniwamreg.exe
"C:\Windows\SysWOW64\waniwamreg.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\waniwamreg.exe
  "C:\Windows\SysWOW64\waniwamreg.exe"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/520-94-0x00000000000E0000-0x00000000000F7000-memory.dmp

Filesize
92KB

Download
memory/520-91-0x0000000000C50000-0x0000000000D35000-memory.dmp

Filesize
916KB

Download
memory/520-92-0x00000000000E0000-0x00000000000F7000-memory.dmp

Filesize
92KB

Download
memory/520-93-0x0000000000340000-0x0000000000360000-memory.dmp

Filesize
128KB

Download
memory/520-86-0x00000000002A0000-0x00000000002B7000-memory.dmp

Filesize
92KB

Download
memory/520-82-0x00000000002A0000-0x00000000002B7000-memory.dmp

Filesize
92KB

Download
memory/1272-66-0x0000000000430000-0x0000000000447000-memory.dmp

Filesize
92KB

Download
memory/1272-70-0x0000000000C50000-0x0000000000D35000-memory.dmp

Filesize
916KB

Download
memory/1272-71-0x0000000000410000-0x0000000000427000-memory.dmp

Filesize
92KB

Download
memory/1272-72-0x0000000000450000-0x0000000000470000-memory.dmp

Filesize
128KB

Download
memory/1272-90-0x0000000000410000-0x0000000000427000-memory.dmp

Filesize
92KB

Download
memory/1272-62-0x0000000000430000-0x0000000000447000-memory.dmp

Filesize
92KB

Download
memory/1392-54-0x0000000075C41000-0x0000000075C43000-memory.dmp

Filesize
8KB

Download
memory/1392-68-0x0000000000420000-0x0000000000437000-memory.dmp

Filesize
92KB

Download
memory/1392-69-0x0000000000460000-0x0000000000480000-memory.dmp

Filesize
128KB

Download
memory/1392-67-0x0000000000C50000-0x0000000000D35000-memory.dmp

Filesize
916KB

Download
memory/1392-59-0x0000000000440000-0x0000000000457000-memory.dmp

Filesize
92KB

Download
memory/1392-55-0x0000000000440000-0x0000000000457000-memory.dmp

Filesize
92KB

Download
memory/1500-74-0x00000000002F0000-0x0000000000307000-memory.dmp

Filesize
92KB

Download
memory/1500-89-0x0000000000380000-0x00000000003A0000-memory.dmp

Filesize
128KB

Download
memory/1500-88-0x0000000000250000-0x0000000000267000-memory.dmp

Filesize
92KB

Download
memory/1500-87-0x0000000000C50000-0x0000000000D35000-memory.dmp

Filesize
916KB

Download
memory/1500-78-0x00000000002F0000-0x0000000000307000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing