emotet | 572364a36ab856bf456d4bbe0c1e2727690bb7806a3311087e79e573cdb56854

General

Target

572364a36ab856bf456d4bbe0c1e2727690bb7806a3311087e79e573cdb56854.exe
Size

113KB
MD5

7611776a4693c2b77957cc213036345d
SHA1

6e176c3f6db12a08674633252085bd96eac3de17
SHA256

572364a36ab856bf456d4bbe0c1e2727690bb7806a3311087e79e573cdb56854
SHA512

61deddbb3444e48fec1b2dc3d87b3c3a2e7d566050e7be64670d3cda12e93b4373d59603755c59c7d77e7f3ea692396a0d55fca5b8d21f0498c9d84215b1248e

Score

10^/10

emotet banker suricata trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE Win32/Emotet CnC Checkin (POST)
suricata: ET MALWARE Win32/Emotet CnC Checkin (POST)
suricata

Drops file in System32 directory 1 IoCs

Processes:

bitsdcom.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	bitsdcom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

bitsdcom.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-64-60-a3-0c-ed\WpadDecisionReason = "1"	bitsdcom.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-64-60-a3-0c-ed\WpadDecision = "0"	bitsdcom.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	bitsdcom.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	bitsdcom.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	bitsdcom.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00cc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	bitsdcom.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ED4E3C32-E9E3-4CCE-BDAD-D0905E077CEE}\WpadDecision = "0"	bitsdcom.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ED4E3C32-E9E3-4CCE-BDAD-D0905E077CEE}\WpadNetworkName = "Network 3"	bitsdcom.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	bitsdcom.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	bitsdcom.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	bitsdcom.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ED4E3C32-E9E3-4CCE-BDAD-D0905E077CEE}\WpadDecisionTime = 00269cadcf9fd801	bitsdcom.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	bitsdcom.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	bitsdcom.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	bitsdcom.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ED4E3C32-E9E3-4CCE-BDAD-D0905E077CEE}	bitsdcom.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	bitsdcom.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ED4E3C32-E9E3-4CCE-BDAD-D0905E077CEE}\WpadDecisionReason = "1"	bitsdcom.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-64-60-a3-0c-ed	bitsdcom.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ED4E3C32-E9E3-4CCE-BDAD-D0905E077CEE}\0a-64-60-a3-0c-ed	bitsdcom.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-64-60-a3-0c-ed\WpadDecisionTime = 00269cadcf9fd801	bitsdcom.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

bitsdcom.exe

pid process

1756 bitsdcom.exe
1756 bitsdcom.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

572364a36ab856bf456d4bbe0c1e2727690bb7806a3311087e79e573cdb56854.exe

pid process

1972 572364a36ab856bf456d4bbe0c1e2727690bb7806a3311087e79e573cdb56854.exe

pid	process
1756	bitsdcom.exe
1756	bitsdcom.exe

pid	process
1972	572364a36ab856bf456d4bbe0c1e2727690bb7806a3311087e79e573cdb56854.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

572364a36ab856bf456d4bbe0c1e2727690bb7806a3311087e79e573cdb56854.exebitsdcom.exebitsdcom.exe

description	pid	process	target process
PID 1476 wrote to memory of 1972	1476	572364a36ab856bf456d4bbe0c1e2727690bb7806a3311087e79e573cdb56854.exe	572364a36ab856bf456d4bbe0c1e2727690bb7806a3311087e79e573cdb56854.exe
PID 1476 wrote to memory of 1972	1476	572364a36ab856bf456d4bbe0c1e2727690bb7806a3311087e79e573cdb56854.exe	572364a36ab856bf456d4bbe0c1e2727690bb7806a3311087e79e573cdb56854.exe
PID 1476 wrote to memory of 1972	1476	572364a36ab856bf456d4bbe0c1e2727690bb7806a3311087e79e573cdb56854.exe	572364a36ab856bf456d4bbe0c1e2727690bb7806a3311087e79e573cdb56854.exe
PID 1476 wrote to memory of 1972	1476	572364a36ab856bf456d4bbe0c1e2727690bb7806a3311087e79e573cdb56854.exe	572364a36ab856bf456d4bbe0c1e2727690bb7806a3311087e79e573cdb56854.exe
PID 1072 wrote to memory of 1160	1072	bitsdcom.exe	bitsdcom.exe
PID 1072 wrote to memory of 1160	1072	bitsdcom.exe	bitsdcom.exe
PID 1072 wrote to memory of 1160	1072	bitsdcom.exe	bitsdcom.exe
PID 1072 wrote to memory of 1160	1072	bitsdcom.exe	bitsdcom.exe
PID 1160 wrote to memory of 1756	1160	bitsdcom.exe	bitsdcom.exe
PID 1160 wrote to memory of 1756	1160	bitsdcom.exe	bitsdcom.exe
PID 1160 wrote to memory of 1756	1160	bitsdcom.exe	bitsdcom.exe
PID 1160 wrote to memory of 1756	1160	bitsdcom.exe	bitsdcom.exe

C:\Users\Admin\AppData\Local\Temp\572364a36ab856bf456d4bbe0c1e2727690bb7806a3311087e79e573cdb56854.exe
"C:\Users\Admin\AppData\Local\Temp\572364a36ab856bf456d4bbe0c1e2727690bb7806a3311087e79e573cdb56854.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Users\Admin\AppData\Local\Temp\572364a36ab856bf456d4bbe0c1e2727690bb7806a3311087e79e573cdb56854.exe
  "C:\Users\Admin\AppData\Local\Temp\572364a36ab856bf456d4bbe0c1e2727690bb7806a3311087e79e573cdb56854.exe"
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1972

C:\Windows\SysWOW64\bitsdcom.exe
C:\Windows\SysWOW64\bitsdcom.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\bitsdcom.exe
  "C:\Windows\SysWOW64\bitsdcom.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\SysWOW64\bitsdcom.exe
    "C:\Windows\SysWOW64\bitsdcom.exe"
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1072-72-0x00000000003B0000-0x00000000003BE000-memory.dmp

Filesize
56KB

Download
memory/1072-79-0x00000000003C0000-0x00000000003D0000-memory.dmp

Filesize
64KB

Download
memory/1072-78-0x0000000000310000-0x000000000031E000-memory.dmp

Filesize
56KB

Download
memory/1072-76-0x00000000003B0000-0x00000000003BE000-memory.dmp

Filesize
56KB

Download
memory/1160-87-0x0000000000310000-0x000000000031E000-memory.dmp

Filesize
56KB

Download
memory/1160-77-0x0000000000000000-mapping.dmp

Download
memory/1160-88-0x00000000003B0000-0x00000000003C0000-memory.dmp

Filesize
64KB

Download
memory/1160-85-0x0000000000320000-0x000000000032E000-memory.dmp

Filesize
56KB

Download
memory/1160-81-0x0000000000320000-0x000000000032E000-memory.dmp

Filesize
56KB

Download
memory/1476-54-0x00000000002E0000-0x00000000002EE000-memory.dmp

Filesize
56KB

Download
memory/1476-62-0x00000000002E0000-0x00000000002EE000-memory.dmp

Filesize
56KB

Download
memory/1476-55-0x00000000003F0000-0x00000000003FE000-memory.dmp

Filesize
56KB

Download
memory/1476-61-0x0000000000430000-0x0000000000440000-memory.dmp

Filesize
64KB

Download
memory/1476-59-0x00000000003F0000-0x00000000003FE000-memory.dmp

Filesize
56KB

Download
memory/1756-86-0x0000000000000000-mapping.dmp

Download
memory/1756-89-0x0000000000250000-0x000000000025E000-memory.dmp

Filesize
56KB

Download
memory/1756-97-0x00000000001C0000-0x00000000001CE000-memory.dmp

Filesize
56KB

Download
memory/1756-96-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/1756-95-0x00000000001C0000-0x00000000001CE000-memory.dmp

Filesize
56KB

Download
memory/1756-93-0x0000000000250000-0x000000000025E000-memory.dmp

Filesize
56KB

Download
memory/1972-70-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/1972-67-0x00000000003E0000-0x00000000003EE000-memory.dmp

Filesize
56KB

Download
memory/1972-63-0x00000000003E0000-0x00000000003EE000-memory.dmp

Filesize
56KB

Download
memory/1972-68-0x00000000768C1000-0x00000000768C3000-memory.dmp

Filesize
8KB

Download
memory/1972-69-0x0000000000250000-0x000000000025E000-memory.dmp

Filesize
56KB

Download
memory/1972-60-0x0000000000000000-mapping.dmp

Download
memory/1972-80-0x0000000000250000-0x000000000025E000-memory.dmp

Filesize
56KB

Download
memory/1972-71-0x0000000000250000-0x000000000025E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads