emotet | 57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853

General

Target

57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe
Size

97KB
MD5

0c20d35a0e69df4826f19cd8e9dce316
SHA1

a0428d06e5ff29106459ecca196e9d31726b6176
SHA256

57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853
SHA512

518806cf49d887b666d27a37823645a73aa06fe3e804dc1f4c68978fd39d9b1628a520d9129f3e7fb59b1c309c8fcbad71dfb60df2d3bdacadbdcf86f3e776c7

Score

10^/10

emotet banker suricata trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet.v4 Checkin
suricata: ET MALWARE W32/Emotet.v4 Checkin
suricata

Drops file in System32 directory 4 IoCs

Processes:

HibernateAcc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	HibernateAcc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	HibernateAcc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	HibernateAcc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	HibernateAcc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

HibernateAcc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	HibernateAcc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	HibernateAcc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	HibernateAcc.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

HibernateAcc.exe

pid	process
1676	HibernateAcc.exe
1676	HibernateAcc.exe
1676	HibernateAcc.exe
1676	HibernateAcc.exe
1676	HibernateAcc.exe
1676	HibernateAcc.exe
1676	HibernateAcc.exe
1676	HibernateAcc.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe

pid process

792 57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe

pid	process
792	57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exeHibernateAcc.exe

description	pid	process	target process
PID 4180 wrote to memory of 792	4180	57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe	57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe
PID 4180 wrote to memory of 792	4180	57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe	57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe
PID 4180 wrote to memory of 792	4180	57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe	57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe
PID 2464 wrote to memory of 1676	2464	HibernateAcc.exe	HibernateAcc.exe
PID 2464 wrote to memory of 1676	2464	HibernateAcc.exe	HibernateAcc.exe
PID 2464 wrote to memory of 1676	2464	HibernateAcc.exe	HibernateAcc.exe

C:\Users\Admin\AppData\Local\Temp\57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe
"C:\Users\Admin\AppData\Local\Temp\57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4180

C:\Users\Admin\AppData\Local\Temp\57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe
"C:\Users\Admin\AppData\Local\Temp\57110fbd2b3f669751d60201356c2036a15bb72af9e638453efbfe6800102853.exe"
2⤵
- Suspicious behavior: RenamesItself
PID:792

C:\Windows\SysWOW64\HibernateAcc.exe
C:\Windows\SysWOW64\HibernateAcc.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2464

C:\Windows\SysWOW64\HibernateAcc.exe
"C:\Windows\SysWOW64\HibernateAcc.exe"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1676

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/792-137-0x0000000000000000-mapping.dmp

Download
memory/792-138-0x0000000000590000-0x000000000059E000-memory.dmp

Filesize
56KB

Download
memory/792-142-0x0000000000590000-0x000000000059E000-memory.dmp

Filesize
56KB

Download
memory/792-159-0x0000000000570000-0x000000000057E000-memory.dmp

Filesize
56KB

Download
memory/792-144-0x0000000000570000-0x000000000057E000-memory.dmp

Filesize
56KB

Download
memory/792-145-0x00000000005A0000-0x00000000005B0000-memory.dmp

Filesize
64KB

Download
memory/1676-151-0x0000000000000000-mapping.dmp

Download
memory/1676-162-0x0000000000EA0000-0x0000000000EAE000-memory.dmp

Filesize
56KB

Download
memory/1676-161-0x0000000000ED0000-0x0000000000EE0000-memory.dmp

Filesize
64KB

Download
memory/1676-160-0x0000000000EA0000-0x0000000000EAE000-memory.dmp

Filesize
56KB

Download
memory/1676-156-0x0000000000EC0000-0x0000000000ECE000-memory.dmp

Filesize
56KB

Download
memory/1676-152-0x0000000000EC0000-0x0000000000ECE000-memory.dmp

Filesize
56KB

Download
memory/2464-146-0x0000000000D20000-0x0000000000D2E000-memory.dmp

Filesize
56KB

Download
memory/2464-150-0x0000000000D20000-0x0000000000D2E000-memory.dmp

Filesize
56KB

Download
memory/2464-157-0x00000000009C0000-0x00000000009CE000-memory.dmp

Filesize
56KB

Download
memory/2464-158-0x0000000000D30000-0x0000000000D40000-memory.dmp

Filesize
64KB

Download
memory/4180-130-0x0000000002B50000-0x0000000002B5E000-memory.dmp

Filesize
56KB

Download
memory/4180-143-0x0000000002B30000-0x0000000002B3E000-memory.dmp

Filesize
56KB

Download
memory/4180-136-0x0000000002B60000-0x0000000002B70000-memory.dmp

Filesize
64KB

Download
memory/4180-135-0x0000000002B30000-0x0000000002B3E000-memory.dmp

Filesize
56KB

Download
memory/4180-134-0x0000000002B50000-0x0000000002B5E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads