emotet | 605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a

General

Target

605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe
Size

103KB
MD5

540dc9c34c792d31e1809e86530062e8
SHA1

d6d7c67c7de33864da4b34c005caebe9f03f5e25
SHA256

605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a
SHA512

8e9037e66b5918b7f94720f9092ac277cb17e26f216a15b8e3cd064cf901f7b8ff5703b9f74f530bd128fb8d67007bba8c0eaaaa58a0349b51acc12da5ce6dd2
SSDEEP

3072:m98xkK5h5xwPDTZrJ/rqJcd1Jj7z3nYxGp:muxkgh5orrJTYy

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

redistiprop.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	redistiprop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1512 1356 WerFault.exe redistiprop.exe

pid	pid_target	process	target process
1512	1356	WerFault.exe	redistiprop.exe

Modifies data under HKEY_USERS 11 IoCs

Processes:

redistiprop.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	redistiprop.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	redistiprop.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0041000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	redistiprop.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	redistiprop.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	redistiprop.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	redistiprop.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	redistiprop.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	redistiprop.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	redistiprop.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	redistiprop.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	redistiprop.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

redistiprop.exe

pid process

1356 redistiprop.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe

pid process

1104 605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe

pid	process
1356	redistiprop.exe

pid	process
1104	605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe

Suspicious use of UnmapMainImage 4 IoCs

Processes:

605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exeredistiprop.exeredistiprop.exe

pid	process
896	605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe
1104	605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe
1900	redistiprop.exe
1356	redistiprop.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exeredistiprop.exeredistiprop.exe

description	pid	process	target process
PID 896 wrote to memory of 1104	896	605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe	605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe
PID 896 wrote to memory of 1104	896	605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe	605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe
PID 896 wrote to memory of 1104	896	605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe	605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe
PID 896 wrote to memory of 1104	896	605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe	605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe
PID 1900 wrote to memory of 1356	1900	redistiprop.exe	redistiprop.exe
PID 1900 wrote to memory of 1356	1900	redistiprop.exe	redistiprop.exe
PID 1900 wrote to memory of 1356	1900	redistiprop.exe	redistiprop.exe
PID 1900 wrote to memory of 1356	1900	redistiprop.exe	redistiprop.exe
PID 1356 wrote to memory of 1512	1356	redistiprop.exe	WerFault.exe
PID 1356 wrote to memory of 1512	1356	redistiprop.exe	WerFault.exe
PID 1356 wrote to memory of 1512	1356	redistiprop.exe	WerFault.exe
PID 1356 wrote to memory of 1512	1356	redistiprop.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe
"C:\Users\Admin\AppData\Local\Temp\605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:896

C:\Users\Admin\AppData\Local\Temp\605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe
--cc6a731e
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:1104

C:\Windows\SysWOW64\redistiprop.exe
"C:\Windows\SysWOW64\redistiprop.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\SysWOW64\redistiprop.exe
--2b773269
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 584
3⤵
- Program crash
PID:1512

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/896-59-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/896-55-0x0000000000220000-0x0000000000231000-memory.dmp

Filesize
68KB

Download
memory/896-54-0x0000000075E81000-0x0000000075E83000-memory.dmp

Filesize
8KB

Download
memory/896-57-0x0000000000220000-0x0000000000231000-memory.dmp

Filesize
68KB

Download
memory/1104-61-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1104-60-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1104-56-0x0000000000000000-mapping.dmp

Download
memory/1104-64-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1356-63-0x0000000000000000-mapping.dmp

Download
memory/1356-66-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1356-67-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1356-69-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1512-68-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads