emotet | 54bc56e089ad144f902f0a478365628e3c7b0a1739abb56200c3e1a724fd5232

General

Target

54bc56e089ad144f902f0a478365628e3c7b0a1739abb56200c3e1a724fd5232.exe
Size

136KB
MD5

7ebfdaade79a9176976fa08d700204ac
SHA1

58cb57bd8b5dbd1d85ba931f20522e93666141e6
SHA256

54bc56e089ad144f902f0a478365628e3c7b0a1739abb56200c3e1a724fd5232
SHA512

ecc1501a1e547d853d8e14a284b68235c2c26871a4aa5e46bb3bfe78278ca64ee99f07d0a828ee795312348796be3f4aaf0c331d70417f98dbe558c151bc33b9

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	dasmrcnot.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{67F4D8E0-033A-4E89-9265-8ABDDD06C242}\WpadDecision = "0"	dasmrcnot.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-46-d2-a1-6f-e4\WpadDecisionReason = "1"	dasmrcnot.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{67F4D8E0-033A-4E89-9265-8ABDDD06C242}\36-46-d2-a1-6f-e4	dasmrcnot.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	dasmrcnot.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00f2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	dasmrcnot.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	dasmrcnot.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{67F4D8E0-033A-4E89-9265-8ABDDD06C242}	dasmrcnot.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{67F4D8E0-033A-4E89-9265-8ABDDD06C242}\WpadDecisionReason = "1"	dasmrcnot.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{67F4D8E0-033A-4E89-9265-8ABDDD06C242}\WpadDecisionTime = 506f03febea0d801	dasmrcnot.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-46-d2-a1-6f-e4	dasmrcnot.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-46-d2-a1-6f-e4\WpadDecisionTime = 506f03febea0d801	dasmrcnot.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	dasmrcnot.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	dasmrcnot.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	dasmrcnot.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{67F4D8E0-033A-4E89-9265-8ABDDD06C242}\WpadNetworkName = "Network 3"	dasmrcnot.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-46-d2-a1-6f-e4\WpadDecision = "0"	dasmrcnot.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	dasmrcnot.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	dasmrcnot.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1092	54bc56e089ad144f902f0a478365628e3c7b0a1739abb56200c3e1a724fd5232.exe
1924	54bc56e089ad144f902f0a478365628e3c7b0a1739abb56200c3e1a724fd5232.exe
2044	dasmrcnot.exe
2028	dasmrcnot.exe
2028	dasmrcnot.exe
2028	dasmrcnot.exe
2028	dasmrcnot.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1924	54bc56e089ad144f902f0a478365628e3c7b0a1739abb56200c3e1a724fd5232.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1924	1092	54bc56e089ad144f902f0a478365628e3c7b0a1739abb56200c3e1a724fd5232.exe	27
PID 1092 wrote to memory of 1924	1092	54bc56e089ad144f902f0a478365628e3c7b0a1739abb56200c3e1a724fd5232.exe	27
PID 1092 wrote to memory of 1924	1092	54bc56e089ad144f902f0a478365628e3c7b0a1739abb56200c3e1a724fd5232.exe	27
PID 1092 wrote to memory of 1924	1092	54bc56e089ad144f902f0a478365628e3c7b0a1739abb56200c3e1a724fd5232.exe	27
PID 2044 wrote to memory of 2028	2044	dasmrcnot.exe	29
PID 2044 wrote to memory of 2028	2044	dasmrcnot.exe	29
PID 2044 wrote to memory of 2028	2044	dasmrcnot.exe	29
PID 2044 wrote to memory of 2028	2044	dasmrcnot.exe	29

C:\Users\Admin\AppData\Local\Temp\54bc56e089ad144f902f0a478365628e3c7b0a1739abb56200c3e1a724fd5232.exe
"C:\Users\Admin\AppData\Local\Temp\54bc56e089ad144f902f0a478365628e3c7b0a1739abb56200c3e1a724fd5232.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Users\Admin\AppData\Local\Temp\54bc56e089ad144f902f0a478365628e3c7b0a1739abb56200c3e1a724fd5232.exe
  "C:\Users\Admin\AppData\Local\Temp\54bc56e089ad144f902f0a478365628e3c7b0a1739abb56200c3e1a724fd5232.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  PID:1924

C:\Windows\SysWOW64\dasmrcnot.exe
"C:\Windows\SysWOW64\dasmrcnot.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\dasmrcnot.exe
  "C:\Windows\SysWOW64\dasmrcnot.exe"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1092-63-0x0000000000100000-0x000000000011A000-memory.dmp

Filesize
104KB

Download
memory/1092-54-0x0000000000170000-0x000000000018A000-memory.dmp

Filesize
104KB

Download
memory/1092-64-0x0000000000190000-0x00000000001A8000-memory.dmp

Filesize
96KB

Download
memory/1924-66-0x00000000005C0000-0x00000000005D8000-memory.dmp

Filesize
96KB

Download
memory/1924-59-0x0000000000180000-0x000000000019A000-memory.dmp

Filesize
104KB

Download
memory/1924-65-0x0000000000090000-0x00000000000AA000-memory.dmp

Filesize
104KB

Download
memory/1924-67-0x0000000075481000-0x0000000075483000-memory.dmp

Filesize
8KB

Download
memory/1924-79-0x0000000000090000-0x00000000000AA000-memory.dmp

Filesize
104KB

Download
memory/2028-80-0x00000000000D0000-0x00000000000EA000-memory.dmp

Filesize
104KB

Download
memory/2028-73-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download
memory/2028-83-0x00000000000D0000-0x00000000000EA000-memory.dmp

Filesize
104KB

Download
memory/2028-81-0x0000000000280000-0x0000000000298000-memory.dmp

Filesize
96KB

Download
memory/2044-68-0x0000000000190000-0x00000000001AA000-memory.dmp

Filesize
104KB

Download
memory/2044-78-0x0000000000240000-0x0000000000258000-memory.dmp

Filesize
96KB

Download
memory/2044-77-0x0000000000150000-0x000000000016A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing