emotet | 1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a

General

Target

1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe
Size

202KB
MD5

556df6654e1602de66e4ca892949deea
SHA1

6c5174519cbe3d44b07078537cdded554c54eb70
SHA256

1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a
SHA512

0ca1ff6ec4adc395ebbeb88a039fd5021a35f4c0c65cd38f34776141c9244580c9128c99a12f2f2fc5b8a3144b8c6767a45302acb6e667f92bdb0e37ce9d857f
SSDEEP

3072:INkhoRdoQbxSTcbrh82bQZfR3LKHJIWy0WtP0VpIr:INgo3oInbQZpbMJIWa0I

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

sourcebased.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	sourcebased.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

sourcebased.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0037000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	sourcebased.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE973935-7311-45B4-9B0A-4CA8B3B9E6D9}\WpadDecisionTime = f04d27055f06d901	sourcebased.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-b4-37-3a-d2-4b	sourcebased.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE973935-7311-45B4-9B0A-4CA8B3B9E6D9}\72-b4-37-3a-d2-4b	sourcebased.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-b4-37-3a-d2-4b\WpadDecision = "0"	sourcebased.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	sourcebased.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	sourcebased.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE973935-7311-45B4-9B0A-4CA8B3B9E6D9}\WpadNetworkName = "Network 2"	sourcebased.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-b4-37-3a-d2-4b\WpadDecisionTime = f04d27055f06d901	sourcebased.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	sourcebased.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	sourcebased.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	sourcebased.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	sourcebased.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	sourcebased.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	sourcebased.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE973935-7311-45B4-9B0A-4CA8B3B9E6D9}	sourcebased.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE973935-7311-45B4-9B0A-4CA8B3B9E6D9}\WpadDecisionReason = "1"	sourcebased.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE973935-7311-45B4-9B0A-4CA8B3B9E6D9}\WpadDecision = "0"	sourcebased.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-b4-37-3a-d2-4b\WpadDecisionReason = "1"	sourcebased.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	sourcebased.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	sourcebased.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

sourcebased.exe

pid process

676 sourcebased.exe
676 sourcebased.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe

pid process

1108 1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe

pid	process
676	sourcebased.exe
676	sourcebased.exe

pid	process
1108	1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe

Suspicious use of UnmapMainImage 4 IoCs

Processes:

1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exesourcebased.exesourcebased.exe

pid	process
520	1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe
1108	1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe
612	sourcebased.exe
676	sourcebased.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exesourcebased.exe

description	pid	process	target process
PID 520 wrote to memory of 1108	520	1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe	1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe
PID 520 wrote to memory of 1108	520	1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe	1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe
PID 520 wrote to memory of 1108	520	1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe	1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe
PID 520 wrote to memory of 1108	520	1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe	1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe
PID 612 wrote to memory of 676	612	sourcebased.exe	sourcebased.exe
PID 612 wrote to memory of 676	612	sourcebased.exe	sourcebased.exe
PID 612 wrote to memory of 676	612	sourcebased.exe	sourcebased.exe
PID 612 wrote to memory of 676	612	sourcebased.exe	sourcebased.exe

C:\Users\Admin\AppData\Local\Temp\1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe
"C:\Users\Admin\AppData\Local\Temp\1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:520

C:\Users\Admin\AppData\Local\Temp\1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe
--90c4ef23
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:1108

C:\Windows\SysWOW64\sourcebased.exe
"C:\Windows\SysWOW64\sourcebased.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:612

C:\Windows\SysWOW64\sourcebased.exe
--a83d2d2e
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:676

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/520-54-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/520-56-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/520-57-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/676-61-0x0000000000000000-mapping.dmp

Download
memory/676-63-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/676-65-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1108-55-0x0000000000000000-mapping.dmp

Download
memory/1108-58-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1108-59-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/1108-60-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1108-62-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads