emotet | 57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853

General

Target

57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe
Size

97KB
MD5

0c20d35a0e69df4826f19cd8e9dce316
SHA1

a0428d06e5ff29106459ecca196e9d31726b6176
SHA256

57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853
SHA512

518806cf49d887b666d27a37823645a73aa06fe3e804dc1f4c68978fd39d9b1628a520d9129f3e7fb59b1c309c8fcbad71dfb60df2d3bdacadbdcf86f3e776c7

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

AccGlue.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	AccGlue.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

AccGlue.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{84CF563F-69BA-4427-B856-7410E5F16B57}\ee-e8-86-95-11-71	AccGlue.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	AccGlue.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	AccGlue.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	AccGlue.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	AccGlue.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	AccGlue.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	AccGlue.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{84CF563F-69BA-4427-B856-7410E5F16B57}\WpadDecisionTime = b0053094c09fd801	AccGlue.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-e8-86-95-11-71\WpadDecisionReason = "1"	AccGlue.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	AccGlue.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{84CF563F-69BA-4427-B856-7410E5F16B57}	AccGlue.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{84CF563F-69BA-4427-B856-7410E5F16B57}\WpadNetworkName = "Network 3"	AccGlue.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	AccGlue.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{84CF563F-69BA-4427-B856-7410E5F16B57}\WpadDecisionReason = "1"	AccGlue.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{84CF563F-69BA-4427-B856-7410E5F16B57}\WpadDecision = "0"	AccGlue.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-e8-86-95-11-71	AccGlue.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-e8-86-95-11-71\WpadDecisionTime = b0053094c09fd801	AccGlue.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	AccGlue.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	AccGlue.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	AccGlue.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-e8-86-95-11-71\WpadDecision = "0"	AccGlue.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AccGlue.exe

pid process

1160 AccGlue.exe
1160 AccGlue.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe

pid process

900 57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe

pid	process
1160	AccGlue.exe
1160	AccGlue.exe

pid	process
900	57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exeAccGlue.exe

description	pid	process	target process
PID 788 wrote to memory of 900	788	57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe	57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe
PID 788 wrote to memory of 900	788	57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe	57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe
PID 788 wrote to memory of 900	788	57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe	57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe
PID 788 wrote to memory of 900	788	57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe	57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe
PID 1728 wrote to memory of 1160	1728	AccGlue.exe	AccGlue.exe
PID 1728 wrote to memory of 1160	1728	AccGlue.exe	AccGlue.exe
PID 1728 wrote to memory of 1160	1728	AccGlue.exe	AccGlue.exe
PID 1728 wrote to memory of 1160	1728	AccGlue.exe	AccGlue.exe

C:\Users\Admin\AppData\Local\Temp\57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe
"C:\Users\Admin\AppData\Local\Temp\57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:788

C:\Users\Admin\AppData\Local\Temp\57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe
"C:\Users\Admin\AppData\Local\Temp\57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe"
2⤵
- Suspicious behavior: RenamesItself
PID:900

C:\Windows\SysWOW64\AccGlue.exe
C:\Windows\SysWOW64\AccGlue.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\AccGlue.exe
"C:\Windows\SysWOW64\AccGlue.exe"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1160

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/788-66-0x0000000000120000-0x0000000000130000-memory.dmp

Filesize
64KB

Download
memory/788-58-0x0000000000110000-0x000000000011E000-memory.dmp

Filesize
56KB

Download
memory/788-54-0x0000000000110000-0x000000000011E000-memory.dmp

Filesize
56KB

Download
memory/788-65-0x0000000000100000-0x000000000010E000-memory.dmp

Filesize
56KB

Download
memory/900-68-0x0000000000100000-0x000000000010E000-memory.dmp

Filesize
56KB

Download
memory/900-67-0x0000000076601000-0x0000000076603000-memory.dmp

Filesize
8KB

Download
memory/900-59-0x0000000000000000-mapping.dmp

Download
memory/900-82-0x0000000000100000-0x000000000010E000-memory.dmp

Filesize
56KB

Download
memory/1160-74-0x0000000000000000-mapping.dmp

Download
memory/1160-75-0x00000000001E0000-0x00000000001EE000-memory.dmp

Filesize
56KB

Download
memory/1160-79-0x00000000001E0000-0x00000000001EE000-memory.dmp

Filesize
56KB

Download
memory/1160-83-0x00000000001D0000-0x00000000001DE000-memory.dmp

Filesize
56KB

Download
memory/1160-84-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1160-85-0x00000000001D0000-0x00000000001DE000-memory.dmp

Filesize
56KB

Download
memory/1728-81-0x0000000000100000-0x000000000010E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads