emotet | d7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2

General

Target

d7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2.exe
Size

100KB
MD5

8dc2977abe0b363aca606378bf7fd385
SHA1

82fd6c30ebb2b3b5bb5911a3b57fd29142ce6fa8
SHA256

d7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2
SHA512

59f33d6707902aaa8704420a213541cfb758fe2cdfa49fce82d0c29f941d855d77799ef6cde5e5db6d307b8c620f4ba8eb2466dbb87d798c37757212e5786325
SSDEEP

1536:S9XM2K4Y3kK5MNq5cktsVPkRcT5nEYJyuXtg/7rSLh50Uj7z3nYxV:S98xkK5h5xwPDTZrKrqh50Uj7z3nYxV

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

aclguiddef.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	aclguiddef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

aclguiddef.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{01286542-D0D4-4670-AC43-3FA7EC1E923C}\WpadDecisionReason = "1"	aclguiddef.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	aclguiddef.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	aclguiddef.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	aclguiddef.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	aclguiddef.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0096000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	aclguiddef.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	aclguiddef.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	aclguiddef.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{01286542-D0D4-4670-AC43-3FA7EC1E923C}\WpadNetworkName = "Network 3"	aclguiddef.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{01286542-D0D4-4670-AC43-3FA7EC1E923C}\d2-6e-4a-59-c7-f2	aclguiddef.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	aclguiddef.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	aclguiddef.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	aclguiddef.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{01286542-D0D4-4670-AC43-3FA7EC1E923C}	aclguiddef.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{01286542-D0D4-4670-AC43-3FA7EC1E923C}\WpadDecisionTime = 60268b995006d901	aclguiddef.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-6e-4a-59-c7-f2\WpadDecision = "0"	aclguiddef.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	aclguiddef.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{01286542-D0D4-4670-AC43-3FA7EC1E923C}\WpadDecision = "0"	aclguiddef.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-6e-4a-59-c7-f2	aclguiddef.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-6e-4a-59-c7-f2\WpadDecisionReason = "1"	aclguiddef.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-6e-4a-59-c7-f2\WpadDecisionTime = 60268b995006d901	aclguiddef.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

aclguiddef.exe

pid process

732 aclguiddef.exe
732 aclguiddef.exe
732 aclguiddef.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

d7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2.exe

pid process

960 d7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2.exe

pid	process
732	aclguiddef.exe
732	aclguiddef.exe
732	aclguiddef.exe

pid	process
960	d7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2.exe

Suspicious use of UnmapMainImage 4 IoCs

Processes:

d7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2.exed7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2.exeaclguiddef.exeaclguiddef.exe

pid	process
836	d7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2.exe
960	d7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2.exe
544	aclguiddef.exe
732	aclguiddef.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

d7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2.exeaclguiddef.exe

description	pid	process	target process
PID 836 wrote to memory of 960	836	d7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2.exe	d7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2.exe
PID 836 wrote to memory of 960	836	d7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2.exe	d7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2.exe
PID 836 wrote to memory of 960	836	d7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2.exe	d7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2.exe
PID 836 wrote to memory of 960	836	d7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2.exe	d7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2.exe
PID 544 wrote to memory of 732	544	aclguiddef.exe	aclguiddef.exe
PID 544 wrote to memory of 732	544	aclguiddef.exe	aclguiddef.exe
PID 544 wrote to memory of 732	544	aclguiddef.exe	aclguiddef.exe
PID 544 wrote to memory of 732	544	aclguiddef.exe	aclguiddef.exe

C:\Users\Admin\AppData\Local\Temp\d7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2.exe
"C:\Users\Admin\AppData\Local\Temp\d7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:836

C:\Users\Admin\AppData\Local\Temp\d7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2.exe
--c5edc055
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:960

C:\Windows\SysWOW64\aclguiddef.exe
"C:\Windows\SysWOW64\aclguiddef.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:544

C:\Windows\SysWOW64\aclguiddef.exe
--dbad6b44
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:732

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/732-61-0x0000000000000000-mapping.dmp

Download
memory/836-54-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download
memory/836-56-0x00000000001B0000-0x00000000001C1000-memory.dmp

Filesize
68KB

Download
memory/836-57-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/960-55-0x0000000000000000-mapping.dmp

Download
memory/960-59-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/960-63-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads