emotet | 212e451f8d47c3b1df3364edb01d7cb4b6d6de811a92d038701ccbdc8581f017

General

Target

4b4413f6d7bdb32703173800f023687fca686e6a.exe
Size

113KB
MD5

4e431197b0ec80f9d1feaa4287513d80
SHA1

4b4413f6d7bdb32703173800f023687fca686e6a
SHA256

212e451f8d47c3b1df3364edb01d7cb4b6d6de811a92d038701ccbdc8581f017
SHA512

00545fba5948c9e6f38a278180e06b8c35cc91c2fe9f14dcf346ee83ade126b097ff01486f9f45e1142e1ec83d7492dc36b3d559641ff38984bd26070cf09f05
SSDEEP

3072:NdXoH140klX/1SvgDJ6gwBq1Dp1xzxfU8R4gy:XYH140ko6JvwA1DpDP4L

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

pinnednis.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	pinnednis.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

pinnednis.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EB22AA3F-9A9F-44B1-AA8D-ED4084E7AB0B}\WpadDecision = "0"	pinnednis.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EB22AA3F-9A9F-44B1-AA8D-ED4084E7AB0B}\9e-79-08-c8-07-a5	pinnednis.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-79-08-c8-07-a5\WpadDecisionReason = "1"	pinnednis.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-79-08-c8-07-a5\WpadDecisionTime = 8039027ba304d901	pinnednis.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-79-08-c8-07-a5\WpadDecision = "0"	pinnednis.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	pinnednis.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	pinnednis.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	pinnednis.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EB22AA3F-9A9F-44B1-AA8D-ED4084E7AB0B}\WpadDecisionReason = "1"	pinnednis.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	pinnednis.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	pinnednis.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	pinnednis.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EB22AA3F-9A9F-44B1-AA8D-ED4084E7AB0B}	pinnednis.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-79-08-c8-07-a5	pinnednis.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	pinnednis.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	pinnednis.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0093000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	pinnednis.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EB22AA3F-9A9F-44B1-AA8D-ED4084E7AB0B}\WpadDecisionTime = 8039027ba304d901	pinnednis.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EB22AA3F-9A9F-44B1-AA8D-ED4084E7AB0B}\WpadNetworkName = "Network 3"	pinnednis.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	pinnednis.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	pinnednis.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

pinnednis.exe

pid process

1504 pinnednis.exe
1504 pinnednis.exe
1504 pinnednis.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

4b4413f6d7bdb32703173800f023687fca686e6a.exe

pid process

1176 4b4413f6d7bdb32703173800f023687fca686e6a.exe
Suspicious use of UnmapMainImage 4 IoCs

Processes:

4b4413f6d7bdb32703173800f023687fca686e6a.exe4b4413f6d7bdb32703173800f023687fca686e6a.exepinnednis.exepinnednis.exe

pid process

1516 4b4413f6d7bdb32703173800f023687fca686e6a.exe
1176 4b4413f6d7bdb32703173800f023687fca686e6a.exe
1792 pinnednis.exe
1504 pinnednis.exe

pid	process
1504	pinnednis.exe
1504	pinnednis.exe
1504	pinnednis.exe

pid	process
1176	4b4413f6d7bdb32703173800f023687fca686e6a.exe

pid	process
1516	4b4413f6d7bdb32703173800f023687fca686e6a.exe
1176	4b4413f6d7bdb32703173800f023687fca686e6a.exe
1792	pinnednis.exe
1504	pinnednis.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

4b4413f6d7bdb32703173800f023687fca686e6a.exepinnednis.exe

description	pid	process	target process
PID 1516 wrote to memory of 1176	1516	4b4413f6d7bdb32703173800f023687fca686e6a.exe	4b4413f6d7bdb32703173800f023687fca686e6a.exe
PID 1516 wrote to memory of 1176	1516	4b4413f6d7bdb32703173800f023687fca686e6a.exe	4b4413f6d7bdb32703173800f023687fca686e6a.exe
PID 1516 wrote to memory of 1176	1516	4b4413f6d7bdb32703173800f023687fca686e6a.exe	4b4413f6d7bdb32703173800f023687fca686e6a.exe
PID 1516 wrote to memory of 1176	1516	4b4413f6d7bdb32703173800f023687fca686e6a.exe	4b4413f6d7bdb32703173800f023687fca686e6a.exe
PID 1792 wrote to memory of 1504	1792	pinnednis.exe	pinnednis.exe
PID 1792 wrote to memory of 1504	1792	pinnednis.exe	pinnednis.exe
PID 1792 wrote to memory of 1504	1792	pinnednis.exe	pinnednis.exe
PID 1792 wrote to memory of 1504	1792	pinnednis.exe	pinnednis.exe

C:\Users\Admin\AppData\Local\Temp\4b4413f6d7bdb32703173800f023687fca686e6a.exe
"C:\Users\Admin\AppData\Local\Temp\4b4413f6d7bdb32703173800f023687fca686e6a.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1516

C:\Users\Admin\AppData\Local\Temp\4b4413f6d7bdb32703173800f023687fca686e6a.exe
--cb6f6893
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:1176

C:\Windows\SysWOW64\pinnednis.exe
"C:\Windows\SysWOW64\pinnednis.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\SysWOW64\pinnednis.exe
--6ecdbbb6
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1504

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1176-56-0x0000000000000000-mapping.dmp

Download
memory/1176-60-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1176-63-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1504-62-0x0000000000000000-mapping.dmp

Download
memory/1504-65-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1516-54-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download
memory/1516-55-0x0000000000230000-0x0000000000241000-memory.dmp

Filesize
68KB

Download
memory/1516-57-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1516-59-0x0000000000230000-0x0000000000241000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads