emotet | 8e1316894e392d5cbbc93fa7d667692fb93bcf52f37615427cbeb2ddbf55b695

General

Target

8e1316894e392d5cbbc93fa7d667692fb93bcf52f37615427cbeb2ddbf55b695.exe
Size

134KB
MD5

47bbc6f181589b91fd9a9623ec733ec0
SHA1

98d1104388564b7ff78c458ce929016d7ac8237b
SHA256

8e1316894e392d5cbbc93fa7d667692fb93bcf52f37615427cbeb2ddbf55b695
SHA512

ebfe759921ce1774c4d4384a07fdd1995911fcbf9f41aad6b217e17ec74f78db8b2c64a045cabdae3d148ff72c8cfc42c204e2ebb841c993f47ccfaf3fa19392
SSDEEP

3072:aLt4uylSM0zijiK6Y4wQ1oP3i9AFPe3Z4amXYbts:q4uylSkjiKV4w9P3i9AsJXI

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

policadam.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	policadam.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

policadam.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	policadam.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	policadam.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F37AE381-0E2F-44C2-8317-96EE207D823D}\WpadNetworkName = "Network 2"	policadam.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	policadam.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F37AE381-0E2F-44C2-8317-96EE207D823D}	policadam.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-c1-a4-c1-69-03\WpadDecisionTime = b045f5e77d06d901	policadam.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	policadam.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0017000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	policadam.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-c1-a4-c1-69-03\WpadDecisionReason = "1"	policadam.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	policadam.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	policadam.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	policadam.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F37AE381-0E2F-44C2-8317-96EE207D823D}\WpadDecisionReason = "1"	policadam.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F37AE381-0E2F-44C2-8317-96EE207D823D}\WpadDecisionTime = b045f5e77d06d901	policadam.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	policadam.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	policadam.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	policadam.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-c1-a4-c1-69-03\WpadDecision = "0"	policadam.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F37AE381-0E2F-44C2-8317-96EE207D823D}\WpadDecision = "0"	policadam.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-c1-a4-c1-69-03	policadam.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F37AE381-0E2F-44C2-8317-96EE207D823D}\1e-c1-a4-c1-69-03	policadam.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

policadam.exe

pid process

2028 policadam.exe
2028 policadam.exe
2028 policadam.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

8e1316894e392d5cbbc93fa7d667692fb93bcf52f37615427cbeb2ddbf55b695.exe

pid process

1112 8e1316894e392d5cbbc93fa7d667692fb93bcf52f37615427cbeb2ddbf55b695.exe

pid	process
2028	policadam.exe
2028	policadam.exe
2028	policadam.exe

pid	process
1112	8e1316894e392d5cbbc93fa7d667692fb93bcf52f37615427cbeb2ddbf55b695.exe

Suspicious use of UnmapMainImage 4 IoCs

Processes:

8e1316894e392d5cbbc93fa7d667692fb93bcf52f37615427cbeb2ddbf55b695.exe8e1316894e392d5cbbc93fa7d667692fb93bcf52f37615427cbeb2ddbf55b695.exepolicadam.exepolicadam.exe

pid	process
536	8e1316894e392d5cbbc93fa7d667692fb93bcf52f37615427cbeb2ddbf55b695.exe
1112	8e1316894e392d5cbbc93fa7d667692fb93bcf52f37615427cbeb2ddbf55b695.exe
784	policadam.exe
2028	policadam.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

8e1316894e392d5cbbc93fa7d667692fb93bcf52f37615427cbeb2ddbf55b695.exepolicadam.exe

description	pid	process	target process
PID 536 wrote to memory of 1112	536	8e1316894e392d5cbbc93fa7d667692fb93bcf52f37615427cbeb2ddbf55b695.exe	8e1316894e392d5cbbc93fa7d667692fb93bcf52f37615427cbeb2ddbf55b695.exe
PID 536 wrote to memory of 1112	536	8e1316894e392d5cbbc93fa7d667692fb93bcf52f37615427cbeb2ddbf55b695.exe	8e1316894e392d5cbbc93fa7d667692fb93bcf52f37615427cbeb2ddbf55b695.exe
PID 536 wrote to memory of 1112	536	8e1316894e392d5cbbc93fa7d667692fb93bcf52f37615427cbeb2ddbf55b695.exe	8e1316894e392d5cbbc93fa7d667692fb93bcf52f37615427cbeb2ddbf55b695.exe
PID 536 wrote to memory of 1112	536	8e1316894e392d5cbbc93fa7d667692fb93bcf52f37615427cbeb2ddbf55b695.exe	8e1316894e392d5cbbc93fa7d667692fb93bcf52f37615427cbeb2ddbf55b695.exe
PID 784 wrote to memory of 2028	784	policadam.exe	policadam.exe
PID 784 wrote to memory of 2028	784	policadam.exe	policadam.exe
PID 784 wrote to memory of 2028	784	policadam.exe	policadam.exe
PID 784 wrote to memory of 2028	784	policadam.exe	policadam.exe

C:\Users\Admin\AppData\Local\Temp\8e1316894e392d5cbbc93fa7d667692fb93bcf52f37615427cbeb2ddbf55b695.exe
"C:\Users\Admin\AppData\Local\Temp\8e1316894e392d5cbbc93fa7d667692fb93bcf52f37615427cbeb2ddbf55b695.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:536

C:\Users\Admin\AppData\Local\Temp\8e1316894e392d5cbbc93fa7d667692fb93bcf52f37615427cbeb2ddbf55b695.exe
--abd2a860
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:1112

C:\Windows\SysWOW64\policadam.exe
"C:\Windows\SysWOW64\policadam.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:784

C:\Windows\SysWOW64\policadam.exe
--438c9fac
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:2028

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-55-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/536-56-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1112-54-0x0000000000000000-mapping.dmp

Download
memory/1112-57-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1112-58-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/1112-60-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2028-59-0x0000000000000000-mapping.dmp

Download
memory/2028-61-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2028-63-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads