emotet | ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225

General

Target

ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe
Size

179KB
MD5

458c48b22e6a193d4eb6e013ff3e8cb3
SHA1

95f40b425f869c54fc0e9495a58e9896e68c097b
SHA256

ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225
SHA512

8e4498479757c61a3be0d9b6695bc4dacbf6115e23314c49e499f5a35ea587e8855eb433ddeb2d0c6732d2946d201ae1b6bdf6971495186a172b68244653c865
SSDEEP

3072:nD9MPnIerKU8KpzRgorKy6/HH3/29Uy+Hy/yWXVWm+5iq:nDar8KnsnFy/yR5j

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

basedeap.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	basedeap.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

basedeap.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	basedeap.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	basedeap.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	basedeap.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B20C1852-9BB9-41F7-B262-2BF0D2ACDD65}\WpadDecisionReason = "1"	basedeap.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B20C1852-9BB9-41F7-B262-2BF0D2ACDD65}\WpadDecisionTime = 201362615006d901	basedeap.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-80-78-b5-1c-66\WpadDecisionReason = "1"	basedeap.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	basedeap.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	basedeap.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	basedeap.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	basedeap.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	basedeap.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-80-78-b5-1c-66\WpadDecision = "0"	basedeap.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	basedeap.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B20C1852-9BB9-41F7-B262-2BF0D2ACDD65}\WpadNetworkName = "Network 2"	basedeap.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B20C1852-9BB9-41F7-B262-2BF0D2ACDD65}\3e-80-78-b5-1c-66	basedeap.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	basedeap.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0051000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	basedeap.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B20C1852-9BB9-41F7-B262-2BF0D2ACDD65}	basedeap.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B20C1852-9BB9-41F7-B262-2BF0D2ACDD65}\WpadDecision = "0"	basedeap.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-80-78-b5-1c-66	basedeap.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-80-78-b5-1c-66\WpadDecisionTime = 201362615006d901	basedeap.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

basedeap.exe

pid process

1152 basedeap.exe
1152 basedeap.exe
1152 basedeap.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe

pid process

1224 ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe

pid	process
1152	basedeap.exe
1152	basedeap.exe
1152	basedeap.exe

pid	process
1224	ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe

Suspicious use of UnmapMainImage 4 IoCs

Processes:

ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exeff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exebasedeap.exebasedeap.exe

pid	process
1120	ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe
1224	ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe
660	basedeap.exe
1152	basedeap.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exebasedeap.exe

description	pid	process	target process
PID 1120 wrote to memory of 1224	1120	ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe	ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe
PID 1120 wrote to memory of 1224	1120	ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe	ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe
PID 1120 wrote to memory of 1224	1120	ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe	ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe
PID 1120 wrote to memory of 1224	1120	ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe	ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe
PID 660 wrote to memory of 1152	660	basedeap.exe	basedeap.exe
PID 660 wrote to memory of 1152	660	basedeap.exe	basedeap.exe
PID 660 wrote to memory of 1152	660	basedeap.exe	basedeap.exe
PID 660 wrote to memory of 1152	660	basedeap.exe	basedeap.exe

C:\Users\Admin\AppData\Local\Temp\ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe
"C:\Users\Admin\AppData\Local\Temp\ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1120

C:\Users\Admin\AppData\Local\Temp\ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe
--64044ddf
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:1224

C:\Windows\SysWOW64\basedeap.exe
"C:\Windows\SysWOW64\basedeap.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:660

C:\Windows\SysWOW64\basedeap.exe
--8d9c0693
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1152

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1120-55-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/1120-56-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1152-61-0x0000000000000000-mapping.dmp

Download
memory/1152-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1152-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1224-54-0x0000000000000000-mapping.dmp

Download
memory/1224-57-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/1224-58-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1224-59-0x0000000075291000-0x0000000075293000-memory.dmp

Filesize
8KB

Download
memory/1224-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1224-62-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads