emotet | b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9

General

Target

b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe
Size

349KB
MD5

46dc2c76f068aec1a2c932c6305a5cd1
SHA1

3d3c43218a527ee631f68320b552160adcd5a133
SHA256

b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9
SHA512

b53056dc09042c800b756339fe4db1bf4895bb908b452cc5b9292044eb4d051a8477691f68661084e86ec5e8679f287c1432ddbd4e75c2afedaaea8736ca1a3c
SSDEEP

3072:w7i/Yy7XCQW4rKMXxgT1uwdOQbbUzLWpqx+u:oAKCxgAwnbbUzIu

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

culturejersey.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	culturejersey.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1092 1484 WerFault.exe culturejersey.exe

pid	pid_target	process	target process
1092	1484	WerFault.exe	culturejersey.exe

Modifies data under HKEY_USERS 11 IoCs

Processes:

culturejersey.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	culturejersey.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0045000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	culturejersey.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	culturejersey.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	culturejersey.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	culturejersey.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	culturejersey.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	culturejersey.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	culturejersey.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	culturejersey.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	culturejersey.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	culturejersey.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exeb3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.execulturejersey.execulturejersey.exe

pid	process
944	b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe
1328	b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe
468	culturejersey.exe
1484	culturejersey.exe
1484	culturejersey.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe

pid process

1328 b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe

pid	process
1328	b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe

Suspicious use of UnmapMainImage 4 IoCs

Processes:

b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exeb3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.execulturejersey.execulturejersey.exe

pid	process
944	b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe
1328	b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe
468	culturejersey.exe
1484	culturejersey.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.execulturejersey.execulturejersey.exe

description	pid	process	target process
PID 944 wrote to memory of 1328	944	b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe	b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe
PID 944 wrote to memory of 1328	944	b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe	b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe
PID 944 wrote to memory of 1328	944	b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe	b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe
PID 944 wrote to memory of 1328	944	b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe	b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe
PID 468 wrote to memory of 1484	468	culturejersey.exe	culturejersey.exe
PID 468 wrote to memory of 1484	468	culturejersey.exe	culturejersey.exe
PID 468 wrote to memory of 1484	468	culturejersey.exe	culturejersey.exe
PID 468 wrote to memory of 1484	468	culturejersey.exe	culturejersey.exe
PID 1484 wrote to memory of 1092	1484	culturejersey.exe	WerFault.exe
PID 1484 wrote to memory of 1092	1484	culturejersey.exe	WerFault.exe
PID 1484 wrote to memory of 1092	1484	culturejersey.exe	WerFault.exe
PID 1484 wrote to memory of 1092	1484	culturejersey.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe
"C:\Users\Admin\AppData\Local\Temp\b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:944

C:\Users\Admin\AppData\Local\Temp\b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe
"C:\Users\Admin\AppData\Local\Temp\b3ea2eb443529e63babd54926a44d3d269a564972beca227ad47ccc59e767da9.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:1328

C:\Windows\SysWOW64\culturejersey.exe
"C:\Windows\SysWOW64\culturejersey.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:468

C:\Windows\SysWOW64\culturejersey.exe
"C:\Windows\SysWOW64\culturejersey.exe"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 588
3⤵
- Program crash
PID:1092

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/944-54-0x00000000001B0000-0x00000000001C2000-memory.dmp

Filesize
72KB

Download
memory/944-56-0x00000000001B0000-0x00000000001C2000-memory.dmp

Filesize
72KB

Download
memory/944-57-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1092-65-0x0000000000000000-mapping.dmp

Download
memory/1328-55-0x0000000000000000-mapping.dmp

Download
memory/1328-58-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1328-59-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1328-60-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1328-62-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1484-61-0x0000000000000000-mapping.dmp

Download
memory/1484-63-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1484-66-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads