emotet | 1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe
Size

202KB
MD5

556df6654e1602de66e4ca892949deea
SHA1

6c5174519cbe3d44b07078537cdded554c54eb70
SHA256

1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a
SHA512

0ca1ff6ec4adc395ebbeb88a039fd5021a35f4c0c65cd38f34776141c9244580c9128c99a12f2f2fc5b8a3144b8c6767a45302acb6e667f92bdb0e37ce9d857f
SSDEEP

3072:INkhoRdoQbxSTcbrh82bQZfR3LKHJIWy0WtP0VpIr:INgo3oInbQZpbMJIWa0I

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

ipropdetect.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	ipropdetect.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	ipropdetect.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	ipropdetect.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	ipropdetect.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

ipropdetect.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	ipropdetect.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	ipropdetect.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	ipropdetect.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

ipropdetect.exe

pid	process
748	ipropdetect.exe
748	ipropdetect.exe
748	ipropdetect.exe
748	ipropdetect.exe
748	ipropdetect.exe
748	ipropdetect.exe
748	ipropdetect.exe
748	ipropdetect.exe
748	ipropdetect.exe
748	ipropdetect.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe

pid process

4812 1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe

pid	process
4812	1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exeipropdetect.exe

description	pid	process	target process
PID 1616 wrote to memory of 4812	1616	1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe	1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe
PID 1616 wrote to memory of 4812	1616	1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe	1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe
PID 1616 wrote to memory of 4812	1616	1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe	1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe
PID 3780 wrote to memory of 748	3780	ipropdetect.exe	ipropdetect.exe
PID 3780 wrote to memory of 748	3780	ipropdetect.exe	ipropdetect.exe
PID 3780 wrote to memory of 748	3780	ipropdetect.exe	ipropdetect.exe

C:\Users\Admin\AppData\Local\Temp\1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe
"C:\Users\Admin\AppData\Local\Temp\1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1616

C:\Users\Admin\AppData\Local\Temp\1da5cc07a36ffa6f9ef56fa3bfb816bd5d383bbd175f9118002c2d6e30622a0a.exe
--90c4ef23
2⤵
- Suspicious behavior: RenamesItself
PID:4812

C:\Windows\SysWOW64\ipropdetect.exe
"C:\Windows\SysWOW64\ipropdetect.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3780

C:\Windows\SysWOW64\ipropdetect.exe
--da22bf25
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:748

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-137-0x0000000000000000-mapping.dmp

Download
memory/748-139-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/748-140-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1616-132-0x0000000002040000-0x000000000205B000-memory.dmp

Filesize
108KB

Download
memory/1616-135-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1616-134-0x0000000002040000-0x000000000205B000-memory.dmp

Filesize
108KB

Download
memory/4812-133-0x0000000000000000-mapping.dmp

Download
memory/4812-136-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4812-138-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download