emotet | 3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789

General

Target

3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe
Size

123KB
MD5

01f4a2731af96970caec4540b7bf496e
SHA1

1e6264b2243af096fcb4d6658fcbbdd6498f8c42
SHA256

3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789
SHA512

38a8440a318651c67fee6cc8e79e74d64966743a8af1f1becfc8f2769bbd24f2287ae2d76ced0c0fd459f79c9e269c034adde287e58bff67919e8806df54445d
SSDEEP

1536:HXG6Rx3EQR3Mp5UXir1UBbaWzSVvplvCk+mhdIyOHrgZJJgafAMT7KXavwCp:HXGU359Mp6w1aazRDKuOafb/KXavwCp

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

jerseydefine.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	jerseydefine.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

jerseydefine.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	jerseydefine.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	jerseydefine.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	jerseydefine.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0083000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	jerseydefine.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CFF4FA3D-9664-4E20-8EFD-5AB38AA6AFE6}\WpadDecisionReason = "1"	jerseydefine.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-00-62-20-4b-7d\WpadDecisionTime = 30c5a29a8206d901	jerseydefine.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CFF4FA3D-9664-4E20-8EFD-5AB38AA6AFE6}\WpadDecision = "0"	jerseydefine.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CFF4FA3D-9664-4E20-8EFD-5AB38AA6AFE6}\f2-00-62-20-4b-7d	jerseydefine.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-00-62-20-4b-7d\WpadDecisionReason = "1"	jerseydefine.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	jerseydefine.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	jerseydefine.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	jerseydefine.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	jerseydefine.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CFF4FA3D-9664-4E20-8EFD-5AB38AA6AFE6}\WpadDecisionTime = 30c5a29a8206d901	jerseydefine.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-00-62-20-4b-7d	jerseydefine.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	jerseydefine.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	jerseydefine.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	jerseydefine.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CFF4FA3D-9664-4E20-8EFD-5AB38AA6AFE6}	jerseydefine.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CFF4FA3D-9664-4E20-8EFD-5AB38AA6AFE6}\WpadNetworkName = "Network 3"	jerseydefine.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-00-62-20-4b-7d\WpadDecision = "0"	jerseydefine.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exejerseydefine.exejerseydefine.exe

pid	process
1212	3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe
1356	3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe
964	jerseydefine.exe
1640	jerseydefine.exe
1640	jerseydefine.exe
1640	jerseydefine.exe
1640	jerseydefine.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe

pid process

1356 3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe

pid	process
1356	3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe

Suspicious use of UnmapMainImage 4 IoCs

Processes:

3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exejerseydefine.exejerseydefine.exe

pid	process
1212	3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe
1356	3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe
964	jerseydefine.exe
1640	jerseydefine.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exejerseydefine.exe

description	pid	process	target process
PID 1212 wrote to memory of 1356	1212	3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe	3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe
PID 1212 wrote to memory of 1356	1212	3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe	3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe
PID 1212 wrote to memory of 1356	1212	3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe	3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe
PID 1212 wrote to memory of 1356	1212	3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe	3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe
PID 964 wrote to memory of 1640	964	jerseydefine.exe	jerseydefine.exe
PID 964 wrote to memory of 1640	964	jerseydefine.exe	jerseydefine.exe
PID 964 wrote to memory of 1640	964	jerseydefine.exe	jerseydefine.exe
PID 964 wrote to memory of 1640	964	jerseydefine.exe	jerseydefine.exe

C:\Users\Admin\AppData\Local\Temp\3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe
"C:\Users\Admin\AppData\Local\Temp\3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1212

C:\Users\Admin\AppData\Local\Temp\3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe
"C:\Users\Admin\AppData\Local\Temp\3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:1356

C:\Windows\SysWOW64\jerseydefine.exe
"C:\Windows\SysWOW64\jerseydefine.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\SysWOW64\jerseydefine.exe
"C:\Windows\SysWOW64\jerseydefine.exe"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1640

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/964-59-0x0000000000220000-0x0000000000232000-memory.dmp

Filesize
72KB

Download
memory/1212-55-0x0000000000220000-0x0000000000232000-memory.dmp

Filesize
72KB

Download
memory/1212-56-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1356-54-0x0000000000000000-mapping.dmp

Download
memory/1356-57-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1356-58-0x0000000076711000-0x0000000076713000-memory.dmp

Filesize
8KB

Download
memory/1356-61-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1640-60-0x0000000000000000-mapping.dmp

Download
memory/1640-62-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1640-64-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads