emotet | 28af9d9a3be71623d0094d2f0fcd40086c7c41c3ac7a6f8124ab79a36cc54450

General

Target

28af9d9a3be71623d0094d2f0fcd40086c7c41c3ac7a6f8124ab79a36cc54450.exe
Size

185KB
MD5

7a1a90ea63cc1baa6da4a55b451b7fb2
SHA1

6f91cd31e50aae9a4023a2401da3403db42fe901
SHA256

28af9d9a3be71623d0094d2f0fcd40086c7c41c3ac7a6f8124ab79a36cc54450
SHA512

582f39b34461b84406a82e530b445557dce89762929ed8d2d6ad24b14c17e972b7a68177047c3dfdd3fef5d4e8d4ecd546ee19bec3f098206e22fea3f1910e52
SSDEEP

3072:c8ENSRg5KrR52iOG7jWXlnYNav5KLdIIPF4j5dFp:c8KSRg5KPHOGErRKL6Gc

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

selflow.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	selflow.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

selflow.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	selflow.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{780167D9-F59A-4A45-B4ED-2AB847174427}\WpadDecisionTime = f080df7d7806d901	selflow.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{780167D9-F59A-4A45-B4ED-2AB847174427}\WpadNetworkName = "Network 2"	selflow.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	selflow.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	selflow.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	selflow.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	selflow.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	selflow.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-d8-5c-a7-f4-67	selflow.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{780167D9-F59A-4A45-B4ED-2AB847174427}\72-d8-5c-a7-f4-67	selflow.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-d8-5c-a7-f4-67\WpadDecision = "0"	selflow.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	selflow.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	selflow.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	selflow.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0014000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	selflow.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{780167D9-F59A-4A45-B4ED-2AB847174427}	selflow.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{780167D9-F59A-4A45-B4ED-2AB847174427}\WpadDecisionReason = "1"	selflow.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-d8-5c-a7-f4-67\WpadDecisionTime = f080df7d7806d901	selflow.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	selflow.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{780167D9-F59A-4A45-B4ED-2AB847174427}\WpadDecision = "0"	selflow.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-d8-5c-a7-f4-67\WpadDecisionReason = "1"	selflow.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

selflow.exe

pid process

268 selflow.exe
268 selflow.exe
268 selflow.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

28af9d9a3be71623d0094d2f0fcd40086c7c41c3ac7a6f8124ab79a36cc54450.exe

pid process

1288 28af9d9a3be71623d0094d2f0fcd40086c7c41c3ac7a6f8124ab79a36cc54450.exe

pid	process
268	selflow.exe
268	selflow.exe
268	selflow.exe

pid	process
1288	28af9d9a3be71623d0094d2f0fcd40086c7c41c3ac7a6f8124ab79a36cc54450.exe

Suspicious use of UnmapMainImage 4 IoCs

Processes:

28af9d9a3be71623d0094d2f0fcd40086c7c41c3ac7a6f8124ab79a36cc54450.exe28af9d9a3be71623d0094d2f0fcd40086c7c41c3ac7a6f8124ab79a36cc54450.exeselflow.exeselflow.exe

pid	process
1292	28af9d9a3be71623d0094d2f0fcd40086c7c41c3ac7a6f8124ab79a36cc54450.exe
1288	28af9d9a3be71623d0094d2f0fcd40086c7c41c3ac7a6f8124ab79a36cc54450.exe
1300	selflow.exe
268	selflow.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

28af9d9a3be71623d0094d2f0fcd40086c7c41c3ac7a6f8124ab79a36cc54450.exeselflow.exe

description	pid	process	target process
PID 1292 wrote to memory of 1288	1292	28af9d9a3be71623d0094d2f0fcd40086c7c41c3ac7a6f8124ab79a36cc54450.exe	28af9d9a3be71623d0094d2f0fcd40086c7c41c3ac7a6f8124ab79a36cc54450.exe
PID 1292 wrote to memory of 1288	1292	28af9d9a3be71623d0094d2f0fcd40086c7c41c3ac7a6f8124ab79a36cc54450.exe	28af9d9a3be71623d0094d2f0fcd40086c7c41c3ac7a6f8124ab79a36cc54450.exe
PID 1292 wrote to memory of 1288	1292	28af9d9a3be71623d0094d2f0fcd40086c7c41c3ac7a6f8124ab79a36cc54450.exe	28af9d9a3be71623d0094d2f0fcd40086c7c41c3ac7a6f8124ab79a36cc54450.exe
PID 1292 wrote to memory of 1288	1292	28af9d9a3be71623d0094d2f0fcd40086c7c41c3ac7a6f8124ab79a36cc54450.exe	28af9d9a3be71623d0094d2f0fcd40086c7c41c3ac7a6f8124ab79a36cc54450.exe
PID 1300 wrote to memory of 268	1300	selflow.exe	selflow.exe
PID 1300 wrote to memory of 268	1300	selflow.exe	selflow.exe
PID 1300 wrote to memory of 268	1300	selflow.exe	selflow.exe
PID 1300 wrote to memory of 268	1300	selflow.exe	selflow.exe

C:\Users\Admin\AppData\Local\Temp\28af9d9a3be71623d0094d2f0fcd40086c7c41c3ac7a6f8124ab79a36cc54450.exe
"C:\Users\Admin\AppData\Local\Temp\28af9d9a3be71623d0094d2f0fcd40086c7c41c3ac7a6f8124ab79a36cc54450.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1292

C:\Users\Admin\AppData\Local\Temp\28af9d9a3be71623d0094d2f0fcd40086c7c41c3ac7a6f8124ab79a36cc54450.exe
--6abbd869
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:1288

C:\Windows\SysWOW64\selflow.exe
"C:\Windows\SysWOW64\selflow.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1300

C:\Windows\SysWOW64\selflow.exe
--bbc1af3e
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:268

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-62-0x0000000000000000-mapping.dmp

Download
memory/268-65-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/268-66-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1288-56-0x0000000000000000-mapping.dmp

Download
memory/1288-60-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1288-64-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1292-54-0x00000000762E1000-0x00000000762E3000-memory.dmp

Filesize
8KB

Download
memory/1292-55-0x0000000000220000-0x0000000000231000-memory.dmp

Filesize
68KB

Download
memory/1292-59-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1292-57-0x0000000000220000-0x0000000000231000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads