emotet | 3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789

General

Target

3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe
Size

123KB
MD5

01f4a2731af96970caec4540b7bf496e
SHA1

1e6264b2243af096fcb4d6658fcbbdd6498f8c42
SHA256

3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789
SHA512

38a8440a318651c67fee6cc8e79e74d64966743a8af1f1becfc8f2769bbd24f2287ae2d76ced0c0fd459f79c9e269c034adde287e58bff67919e8806df54445d
SSDEEP

1536:HXG6Rx3EQR3Mp5UXir1UBbaWzSVvplvCk+mhdIyOHrgZJJgafAMT7KXavwCp:HXGU359Mp6w1aazRDKuOafb/KXavwCp

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

culturesubs.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	culturesubs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	culturesubs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	culturesubs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	culturesubs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

culturesubs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	culturesubs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	culturesubs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	culturesubs.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.execulturesubs.execulturesubs.exe

pid	process
1792	3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe
1792	3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe
1704	3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe
1704	3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe
2648	culturesubs.exe
2648	culturesubs.exe
3016	culturesubs.exe
3016	culturesubs.exe
3016	culturesubs.exe
3016	culturesubs.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe

pid process

1704 3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe

pid	process
1704	3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.execulturesubs.exe

description	pid	process	target process
PID 1792 wrote to memory of 1704	1792	3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe	3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe
PID 1792 wrote to memory of 1704	1792	3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe	3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe
PID 1792 wrote to memory of 1704	1792	3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe	3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe
PID 2648 wrote to memory of 3016	2648	culturesubs.exe	culturesubs.exe
PID 2648 wrote to memory of 3016	2648	culturesubs.exe	culturesubs.exe
PID 2648 wrote to memory of 3016	2648	culturesubs.exe	culturesubs.exe

C:\Users\Admin\AppData\Local\Temp\3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe
"C:\Users\Admin\AppData\Local\Temp\3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1792

C:\Users\Admin\AppData\Local\Temp\3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe
"C:\Users\Admin\AppData\Local\Temp\3aed05a09f1123a511c7db979ce32689cde973fd844332e0976fd9004ce50789.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:1704

C:\Windows\SysWOW64\culturesubs.exe
"C:\Windows\SysWOW64\culturesubs.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2648

C:\Windows\SysWOW64\culturesubs.exe
"C:\Windows\SysWOW64\culturesubs.exe"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3016

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-136-0x0000000000000000-mapping.dmp

Download
memory/1704-142-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1704-139-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1704-138-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1792-135-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1792-137-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1792-132-0x0000000000580000-0x0000000000592000-memory.dmp

Filesize
72KB

Download
memory/1792-134-0x0000000000580000-0x0000000000592000-memory.dmp

Filesize
72KB

Download
memory/1792-133-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2648-141-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3016-140-0x0000000000000000-mapping.dmp

Download
memory/3016-143-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3016-144-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads