emotet | 2664a2ce4378bef9bc12987fcd474f4cee94f3fea454921d655a91b711bf8fc6

General

Target

2664a2ce4378bef9bc12987fcd474f4cee94f3fea454921d655a91b711bf8fc6.exe
Size

140KB
MD5

b54ffc6ba8b369c20d93e59a82776781
SHA1

54e18fca6685237a96ee425f254a9f12f83395da
SHA256

2664a2ce4378bef9bc12987fcd474f4cee94f3fea454921d655a91b711bf8fc6
SHA512

dddd6304e907d5f3b65db45fbcbc11d2275a5043fa0a993e49a926b002bc76bd6688740ad03f90f388497f8ee6fb25b67a23ae41c8124aa0e9c996e63c9b9e06
SSDEEP

3072:XmRT9gkAY+PGTs3nhYNOybHbhKkhiiVOKEWH:XmRT9IRt3ne3Dg6

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

mapiwab.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mapiwab.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 18 IoCs

Processes:

mapiwab.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9DA042CF-F016-4622-BAAD-CD89B31FE83F}\36-35-9d-c4-d8-19	mapiwab.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-35-9d-c4-d8-19\WpadDecisionTime = 70672b4c7a06d901	mapiwab.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-35-9d-c4-d8-19\WpadDecision = "0"	mapiwab.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9DA042CF-F016-4622-BAAD-CD89B31FE83F}\WpadNetworkName = "Network 2"	mapiwab.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-35-9d-c4-d8-19	mapiwab.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mapiwab.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mapiwab.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0005000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mapiwab.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9DA042CF-F016-4622-BAAD-CD89B31FE83F}	mapiwab.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9DA042CF-F016-4622-BAAD-CD89B31FE83F}\WpadDecision = "0"	mapiwab.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-35-9d-c4-d8-19\WpadDecisionReason = "1"	mapiwab.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mapiwab.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mapiwab.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mapiwab.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mapiwab.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9DA042CF-F016-4622-BAAD-CD89B31FE83F}\WpadDecisionTime = 70672b4c7a06d901	mapiwab.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mapiwab.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9DA042CF-F016-4622-BAAD-CD89B31FE83F}\WpadDecisionReason = "1"	mapiwab.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

2664a2ce4378bef9bc12987fcd474f4cee94f3fea454921d655a91b711bf8fc6.exe2664a2ce4378bef9bc12987fcd474f4cee94f3fea454921d655a91b711bf8fc6.exemapiwab.exemapiwab.exe

pid	process
864	2664a2ce4378bef9bc12987fcd474f4cee94f3fea454921d655a91b711bf8fc6.exe
1220	2664a2ce4378bef9bc12987fcd474f4cee94f3fea454921d655a91b711bf8fc6.exe
2024	mapiwab.exe
2036	mapiwab.exe
2036	mapiwab.exe
2036	mapiwab.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

2664a2ce4378bef9bc12987fcd474f4cee94f3fea454921d655a91b711bf8fc6.exe

pid process

1220 2664a2ce4378bef9bc12987fcd474f4cee94f3fea454921d655a91b711bf8fc6.exe

pid	process
1220	2664a2ce4378bef9bc12987fcd474f4cee94f3fea454921d655a91b711bf8fc6.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2664a2ce4378bef9bc12987fcd474f4cee94f3fea454921d655a91b711bf8fc6.exemapiwab.exe

description	pid	process	target process
PID 864 wrote to memory of 1220	864	2664a2ce4378bef9bc12987fcd474f4cee94f3fea454921d655a91b711bf8fc6.exe	2664a2ce4378bef9bc12987fcd474f4cee94f3fea454921d655a91b711bf8fc6.exe
PID 864 wrote to memory of 1220	864	2664a2ce4378bef9bc12987fcd474f4cee94f3fea454921d655a91b711bf8fc6.exe	2664a2ce4378bef9bc12987fcd474f4cee94f3fea454921d655a91b711bf8fc6.exe
PID 864 wrote to memory of 1220	864	2664a2ce4378bef9bc12987fcd474f4cee94f3fea454921d655a91b711bf8fc6.exe	2664a2ce4378bef9bc12987fcd474f4cee94f3fea454921d655a91b711bf8fc6.exe
PID 864 wrote to memory of 1220	864	2664a2ce4378bef9bc12987fcd474f4cee94f3fea454921d655a91b711bf8fc6.exe	2664a2ce4378bef9bc12987fcd474f4cee94f3fea454921d655a91b711bf8fc6.exe
PID 2024 wrote to memory of 2036	2024	mapiwab.exe	mapiwab.exe
PID 2024 wrote to memory of 2036	2024	mapiwab.exe	mapiwab.exe
PID 2024 wrote to memory of 2036	2024	mapiwab.exe	mapiwab.exe
PID 2024 wrote to memory of 2036	2024	mapiwab.exe	mapiwab.exe

C:\Users\Admin\AppData\Local\Temp\2664a2ce4378bef9bc12987fcd474f4cee94f3fea454921d655a91b711bf8fc6.exe
"C:\Users\Admin\AppData\Local\Temp\2664a2ce4378bef9bc12987fcd474f4cee94f3fea454921d655a91b711bf8fc6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:864

C:\Users\Admin\AppData\Local\Temp\2664a2ce4378bef9bc12987fcd474f4cee94f3fea454921d655a91b711bf8fc6.exe
"C:\Users\Admin\AppData\Local\Temp\2664a2ce4378bef9bc12987fcd474f4cee94f3fea454921d655a91b711bf8fc6.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:1220

C:\Windows\SysWOW64\mapiwab.exe
"C:\Windows\SysWOW64\mapiwab.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\mapiwab.exe
"C:\Windows\SysWOW64\mapiwab.exe"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2036

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/864-63-0x00000000001F0000-0x000000000020A000-memory.dmp

Filesize
104KB

Download
memory/864-54-0x0000000000210000-0x000000000022A000-memory.dmp

Filesize
104KB

Download
memory/864-64-0x0000000000230000-0x0000000000248000-memory.dmp

Filesize
96KB

Download
memory/1220-68-0x0000000000120000-0x000000000013A000-memory.dmp

Filesize
104KB

Download
memory/1220-59-0x0000000000140000-0x000000000015A000-memory.dmp

Filesize
104KB

Download
memory/1220-65-0x0000000000120000-0x000000000013A000-memory.dmp

Filesize
104KB

Download
memory/1220-66-0x0000000000160000-0x0000000000178000-memory.dmp

Filesize
96KB

Download
memory/1220-67-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/1220-58-0x0000000000000000-mapping.dmp

Download
memory/1220-80-0x0000000000120000-0x000000000013A000-memory.dmp

Filesize
104KB

Download
memory/2024-79-0x0000000000860000-0x0000000000878000-memory.dmp

Filesize
96KB

Download
memory/2024-78-0x00000000004E0000-0x00000000004FA000-memory.dmp

Filesize
104KB

Download
memory/2024-69-0x0000000000500000-0x000000000051A000-memory.dmp

Filesize
104KB

Download
memory/2036-74-0x0000000000280000-0x000000000029A000-memory.dmp

Filesize
104KB

Download
memory/2036-73-0x0000000000000000-mapping.dmp

Download
memory/2036-81-0x0000000000230000-0x000000000024A000-memory.dmp

Filesize
104KB

Download
memory/2036-82-0x00000000002A0000-0x00000000002B8000-memory.dmp

Filesize
96KB

Download
memory/2036-84-0x0000000000230000-0x000000000024A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads