emotet | 9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f

General

Target

9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f.exe
Size

108KB
MD5

c8bd995346f61308e200199c7e041b3c
SHA1

46a39c9425bff794916493459f8bffd9e6915af4
SHA256

9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f
SHA512

9f820d527a5b05d8003d3350ef2428f6d956ec63b42f3d9097df9989f1d1a219841ebe4959eb75c7cc3ab9e36dbebab0e32d9cfc49c114bfc2d7a30373124755
SSDEEP

3072:FCrRG9LgWHyMp6awrpEoNLna7TpP7N5LtgxH:FCrskJaYvn+PdgB

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

aclmheg.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	aclmheg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

aclmheg.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	aclmheg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	aclmheg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	aclmheg.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	aclmheg.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f008a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	aclmheg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{23FFF60C-79BA-4F44-9A4F-7CF5711C7BE5}\WpadDecisionReason = "1"	aclmheg.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{23FFF60C-79BA-4F44-9A4F-7CF5711C7BE5}\0e-0f-4c-99-0a-39	aclmheg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	aclmheg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{23FFF60C-79BA-4F44-9A4F-7CF5711C7BE5}\WpadDecision = "0"	aclmheg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{23FFF60C-79BA-4F44-9A4F-7CF5711C7BE5}\WpadNetworkName = "Network 3"	aclmheg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-0f-4c-99-0a-39\WpadDecisionReason = "1"	aclmheg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-0f-4c-99-0a-39\WpadDecision = "0"	aclmheg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	aclmheg.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	aclmheg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	aclmheg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	aclmheg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	aclmheg.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{23FFF60C-79BA-4F44-9A4F-7CF5711C7BE5}\WpadDecisionTime = 40a5eaa35f06d901	aclmheg.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-0f-4c-99-0a-39\WpadDecisionTime = 40a5eaa35f06d901	aclmheg.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{23FFF60C-79BA-4F44-9A4F-7CF5711C7BE5}	aclmheg.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-0f-4c-99-0a-39	aclmheg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

aclmheg.exe

pid process

1072 aclmheg.exe
1072 aclmheg.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f.exe

pid process

284 9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f.exe

pid	process
1072	aclmheg.exe
1072	aclmheg.exe

pid	process
284	9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f.exe

Suspicious use of UnmapMainImage 4 IoCs

Processes:

9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f.exe9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f.exeaclmheg.exeaclmheg.exe

pid	process
736	9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f.exe
284	9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f.exe
2040	aclmheg.exe
1072	aclmheg.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f.exeaclmheg.exe

description	pid	process	target process
PID 736 wrote to memory of 284	736	9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f.exe	9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f.exe
PID 736 wrote to memory of 284	736	9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f.exe	9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f.exe
PID 736 wrote to memory of 284	736	9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f.exe	9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f.exe
PID 736 wrote to memory of 284	736	9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f.exe	9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f.exe
PID 2040 wrote to memory of 1072	2040	aclmheg.exe	aclmheg.exe
PID 2040 wrote to memory of 1072	2040	aclmheg.exe	aclmheg.exe
PID 2040 wrote to memory of 1072	2040	aclmheg.exe	aclmheg.exe
PID 2040 wrote to memory of 1072	2040	aclmheg.exe	aclmheg.exe

C:\Users\Admin\AppData\Local\Temp\9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f.exe
"C:\Users\Admin\AppData\Local\Temp\9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:736

C:\Users\Admin\AppData\Local\Temp\9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f.exe
--167b5551
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:284

C:\Windows\SysWOW64\aclmheg.exe
"C:\Windows\SysWOW64\aclmheg.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\aclmheg.exe
--22a41d5d
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1072

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/284-55-0x0000000000000000-mapping.dmp

Download
memory/284-59-0x0000000000220000-0x0000000000231000-memory.dmp

Filesize
68KB

Download
memory/284-60-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/284-61-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/284-64-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/736-54-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download
memory/736-56-0x00000000001B0000-0x00000000001C1000-memory.dmp

Filesize
68KB

Download
memory/736-58-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1072-63-0x0000000000000000-mapping.dmp

Download
memory/1072-66-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1072-67-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads