emotet | 4a246b13f50b0bafc9678e7b43403096c591e1e43fe8c5538405d3b567e435dd

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 09:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a246b13f50b0bafc9678e7b43403096c591e1e43fe8c5538405d3b567e435dd.exe
Size

111KB
MD5

aa7feca4f942baa222d23d1c759932ca
SHA1

a27a7c15dd2176a768f60a8fa2a05faa5a2c9970
SHA256

4a246b13f50b0bafc9678e7b43403096c591e1e43fe8c5538405d3b567e435dd
SHA512

b81b6261ab1ddb79d054753728f4bf2873d51a92a1d7dc91bcab61d6fe556a99fc78b93a007d8063b647bf0a0d322b606dbdd6213bb7f3ac197061969f6ac820
SSDEEP

3072:bzumcXvQuDsKmmpVXAF6XhO+EV5IXVWR4c2U40s:bSmcbDs3mppAF6xOlBJVs

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

impladt.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	impladt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	impladt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	impladt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	impladt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

impladt.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	impladt.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	impladt.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	impladt.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

impladt.exe

pid	process
444	impladt.exe
444	impladt.exe
444	impladt.exe
444	impladt.exe
444	impladt.exe
444	impladt.exe
444	impladt.exe
444	impladt.exe
444	impladt.exe
444	impladt.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

4a246b13f50b0bafc9678e7b43403096c591e1e43fe8c5538405d3b567e435dd.exe

pid process

1944 4a246b13f50b0bafc9678e7b43403096c591e1e43fe8c5538405d3b567e435dd.exe

pid	process
1944	4a246b13f50b0bafc9678e7b43403096c591e1e43fe8c5538405d3b567e435dd.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

4a246b13f50b0bafc9678e7b43403096c591e1e43fe8c5538405d3b567e435dd.exeimpladt.exe

description	pid	process	target process
PID 4264 wrote to memory of 1944	4264	4a246b13f50b0bafc9678e7b43403096c591e1e43fe8c5538405d3b567e435dd.exe	4a246b13f50b0bafc9678e7b43403096c591e1e43fe8c5538405d3b567e435dd.exe
PID 4264 wrote to memory of 1944	4264	4a246b13f50b0bafc9678e7b43403096c591e1e43fe8c5538405d3b567e435dd.exe	4a246b13f50b0bafc9678e7b43403096c591e1e43fe8c5538405d3b567e435dd.exe
PID 4264 wrote to memory of 1944	4264	4a246b13f50b0bafc9678e7b43403096c591e1e43fe8c5538405d3b567e435dd.exe	4a246b13f50b0bafc9678e7b43403096c591e1e43fe8c5538405d3b567e435dd.exe
PID 3156 wrote to memory of 444	3156	impladt.exe	impladt.exe
PID 3156 wrote to memory of 444	3156	impladt.exe	impladt.exe
PID 3156 wrote to memory of 444	3156	impladt.exe	impladt.exe

C:\Users\Admin\AppData\Local\Temp\4a246b13f50b0bafc9678e7b43403096c591e1e43fe8c5538405d3b567e435dd.exe
"C:\Users\Admin\AppData\Local\Temp\4a246b13f50b0bafc9678e7b43403096c591e1e43fe8c5538405d3b567e435dd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4264

C:\Users\Admin\AppData\Local\Temp\4a246b13f50b0bafc9678e7b43403096c591e1e43fe8c5538405d3b567e435dd.exe
--e64e412d
2⤵
- Suspicious behavior: RenamesItself
PID:1944

C:\Windows\SysWOW64\impladt.exe
"C:\Windows\SysWOW64\impladt.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3156

C:\Windows\SysWOW64\impladt.exe
--6fcb5267
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:444

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/444-138-0x0000000000000000-mapping.dmp

Download
memory/444-140-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/444-141-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1944-133-0x0000000000000000-mapping.dmp

Download
memory/1944-136-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1944-137-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1944-139-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4264-132-0x00000000006B0000-0x00000000006C1000-memory.dmp

Filesize
68KB

Download
memory/4264-134-0x00000000006B0000-0x00000000006C1000-memory.dmp

Filesize
68KB

Download
memory/4264-135-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download