emotet | ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225

Analysis

max time kernel
177s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe
Size

179KB
MD5

458c48b22e6a193d4eb6e013ff3e8cb3
SHA1

95f40b425f869c54fc0e9495a58e9896e68c097b
SHA256

ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225
SHA512

8e4498479757c61a3be0d9b6695bc4dacbf6115e23314c49e499f5a35ea587e8855eb433ddeb2d0c6732d2946d201ae1b6bdf6971495186a172b68244653c865
SSDEEP

3072:nD9MPnIerKU8KpzRgorKy6/HH3/29Uy+Hy/yWXVWm+5iq:nDar8KnsnFy/yR5j

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

rightbased.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	rightbased.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	rightbased.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	rightbased.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	rightbased.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

rightbased.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	rightbased.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rightbased.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	rightbased.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rightbased.exe

pid process

4528 rightbased.exe
4528 rightbased.exe
4528 rightbased.exe
4528 rightbased.exe
4528 rightbased.exe
4528 rightbased.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe

pid process

4316 ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe

pid	process
4528	rightbased.exe
4528	rightbased.exe
4528	rightbased.exe
4528	rightbased.exe
4528	rightbased.exe
4528	rightbased.exe

pid	process
4316	ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exerightbased.exe

description	pid	process	target process
PID 1472 wrote to memory of 4316	1472	ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe	ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe
PID 1472 wrote to memory of 4316	1472	ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe	ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe
PID 1472 wrote to memory of 4316	1472	ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe	ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe
PID 1752 wrote to memory of 4528	1752	rightbased.exe	rightbased.exe
PID 1752 wrote to memory of 4528	1752	rightbased.exe	rightbased.exe
PID 1752 wrote to memory of 4528	1752	rightbased.exe	rightbased.exe

C:\Users\Admin\AppData\Local\Temp\ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe
"C:\Users\Admin\AppData\Local\Temp\ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1472

C:\Users\Admin\AppData\Local\Temp\ff41b9d03abe184995f54936081f0e24b914021e2e73a2b4b7824180add14225.exe
--64044ddf
2⤵
- Suspicious behavior: RenamesItself
PID:4316

C:\Windows\SysWOW64\rightbased.exe
"C:\Windows\SysWOW64\rightbased.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\rightbased.exe
--ada9249
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4528

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1472-132-0x0000000000680000-0x000000000069B000-memory.dmp

Filesize
108KB

Download
memory/1472-134-0x0000000000680000-0x000000000069B000-memory.dmp

Filesize
108KB

Download
memory/1472-135-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4316-133-0x0000000000000000-mapping.dmp

Download
memory/4316-136-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4316-137-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4316-139-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4528-138-0x0000000000000000-mapping.dmp

Download
memory/4528-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4528-141-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download