emotet | 605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a

Analysis

max time kernel
364s
max time network
450s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 16:18

Target

605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe
Size

103KB
MD5

540dc9c34c792d31e1809e86530062e8
SHA1

d6d7c67c7de33864da4b34c005caebe9f03f5e25
SHA256

605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a
SHA512

8e9037e66b5918b7f94720f9092ac277cb17e26f216a15b8e3cd064cf901f7b8ff5703b9f74f530bd128fb8d67007bba8c0eaaaa58a0349b51acc12da5ce6dd2
SSDEEP

3072:m98xkK5h5xwPDTZrJ/rqJcd1Jj7z3nYxGp:muxkgh5orrJTYy

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: RenamesItself 1 IoCs

Processes:

605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe

pid process

1644 605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe

pid	process
1644	605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe

description	pid	process	target process
PID 3496 wrote to memory of 1644	3496	605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe	605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe
PID 3496 wrote to memory of 1644	3496	605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe	605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe
PID 3496 wrote to memory of 1644	3496	605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe	605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe

C:\Users\Admin\AppData\Local\Temp\605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe
"C:\Users\Admin\AppData\Local\Temp\605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3496

C:\Users\Admin\AppData\Local\Temp\605b4fbf47c1b87fc38f3036457da59c81c34f09e1b23e58494116935ba3944a.exe
--cc6a731e
2⤵
- Suspicious behavior: RenamesItself
PID:1644

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/1644-136-0x0000000000000000-mapping.dmp

Download
memory/1644-137-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1644-138-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3496-132-0x0000000000680000-0x0000000000691000-memory.dmp

Filesize
68KB

Download
memory/3496-133-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3496-134-0x0000000000680000-0x0000000000691000-memory.dmp

Filesize
68KB

Download
memory/3496-135-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3496-139-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download