emotet | 9480b9c93aed36000436f605d0f61d8068207840c21d9fb6d315e0f33d8a3dcd

Analysis

max time kernel
168s
max time network
215s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9480b9c93aed36000436f605d0f61d8068207840c21d9fb6d315e0f33d8a3dcd.exe
Size

108KB
MD5

582464c529594a4bb279e268830d75a3
SHA1

a6c641469d3bedd122fde536a954d0c12845c15a
SHA256

9480b9c93aed36000436f605d0f61d8068207840c21d9fb6d315e0f33d8a3dcd
SHA512

f5fde8bd38100bf8f4ef7444de137651ffbdf51499929d495c6608579844473a32a00916b7f207481337c3408fe0cd56ab83ad8dbbff8313a1c670f8904c449d
SSDEEP

3072:HFwQXajEou7H7A5GQLcMSmikCJQ+nek46a:lwvjxkJEq05+Za

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

relacl.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	relacl.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	relacl.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	relacl.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	relacl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

relacl.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	relacl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	relacl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	relacl.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

relacl.exe

pid process

3972 relacl.exe
3972 relacl.exe
3972 relacl.exe
3972 relacl.exe
3972 relacl.exe
3972 relacl.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

9480b9c93aed36000436f605d0f61d8068207840c21d9fb6d315e0f33d8a3dcd.exe

pid process

2124 9480b9c93aed36000436f605d0f61d8068207840c21d9fb6d315e0f33d8a3dcd.exe

pid	process
3972	relacl.exe
3972	relacl.exe
3972	relacl.exe
3972	relacl.exe
3972	relacl.exe
3972	relacl.exe

pid	process
2124	9480b9c93aed36000436f605d0f61d8068207840c21d9fb6d315e0f33d8a3dcd.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

9480b9c93aed36000436f605d0f61d8068207840c21d9fb6d315e0f33d8a3dcd.exerelacl.exe

description	pid	process	target process
PID 1688 wrote to memory of 2124	1688	9480b9c93aed36000436f605d0f61d8068207840c21d9fb6d315e0f33d8a3dcd.exe	9480b9c93aed36000436f605d0f61d8068207840c21d9fb6d315e0f33d8a3dcd.exe
PID 1688 wrote to memory of 2124	1688	9480b9c93aed36000436f605d0f61d8068207840c21d9fb6d315e0f33d8a3dcd.exe	9480b9c93aed36000436f605d0f61d8068207840c21d9fb6d315e0f33d8a3dcd.exe
PID 1688 wrote to memory of 2124	1688	9480b9c93aed36000436f605d0f61d8068207840c21d9fb6d315e0f33d8a3dcd.exe	9480b9c93aed36000436f605d0f61d8068207840c21d9fb6d315e0f33d8a3dcd.exe
PID 3628 wrote to memory of 3972	3628	relacl.exe	relacl.exe
PID 3628 wrote to memory of 3972	3628	relacl.exe	relacl.exe
PID 3628 wrote to memory of 3972	3628	relacl.exe	relacl.exe

C:\Users\Admin\AppData\Local\Temp\9480b9c93aed36000436f605d0f61d8068207840c21d9fb6d315e0f33d8a3dcd.exe
"C:\Users\Admin\AppData\Local\Temp\9480b9c93aed36000436f605d0f61d8068207840c21d9fb6d315e0f33d8a3dcd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688

C:\Users\Admin\AppData\Local\Temp\9480b9c93aed36000436f605d0f61d8068207840c21d9fb6d315e0f33d8a3dcd.exe
--7ebe8c2e
2⤵
- Suspicious behavior: RenamesItself
PID:2124

C:\Windows\SysWOW64\relacl.exe
"C:\Windows\SysWOW64\relacl.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3628

C:\Windows\SysWOW64\relacl.exe
--fc5ceac3
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1688-132-0x0000000000670000-0x0000000000681000-memory.dmp

Filesize
68KB

Download
memory/1688-133-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1688-135-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1688-136-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2124-134-0x0000000000000000-mapping.dmp

Download
memory/2124-137-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2124-138-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2124-142-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3628-139-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3972-140-0x0000000000000000-mapping.dmp

Download
memory/3972-141-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3972-143-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download