emotet | 55073efe1efc561f5355ef68cbe011074ab198c5e4e52fb30e48ac62f64b1a57

General

Target

55073efe1efc561f5355ef68cbe011074ab198c5e4e52fb30e48ac62f64b1a57.exe
Size

134KB
MD5

ac4988df4640960f91201063930b8e9a
SHA1

f9b037e8744390170cb0aba551890662711af928
SHA256

55073efe1efc561f5355ef68cbe011074ab198c5e4e52fb30e48ac62f64b1a57
SHA512

f43e2a33418a74a6668aecf6020aaaa9eed7cea470fc6ad872faad489b323cf4d037f7b7d20d0590a0ec5a8f7af2e870fe459ccb5b332f70fa33a33590c438fe
SSDEEP

3072:pAAxt4uylSM0zijiK6Y4wQ1oP3i9AFPdXdZ47AhmXYb0g:9v4uylSkjiKV4w9P3i9A3Xj/hl

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

singlepanes.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	singlepanes.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

singlepanes.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	singlepanes.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{07EF5CA5-5487-4F68-A28B-446A09990724}\de-ad-a6-79-4d-0d	singlepanes.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-ad-a6-79-4d-0d\WpadDecisionTime = d06f93c28d06d901	singlepanes.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{07EF5CA5-5487-4F68-A28B-446A09990724}\WpadDecision = "0"	singlepanes.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-ad-a6-79-4d-0d\WpadDecisionReason = "1"	singlepanes.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	singlepanes.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	singlepanes.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{07EF5CA5-5487-4F68-A28B-446A09990724}	singlepanes.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{07EF5CA5-5487-4F68-A28B-446A09990724}\WpadDecisionTime = d06f93c28d06d901	singlepanes.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-ad-a6-79-4d-0d	singlepanes.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	singlepanes.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	singlepanes.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	singlepanes.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	singlepanes.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{07EF5CA5-5487-4F68-A28B-446A09990724}\WpadDecisionReason = "1"	singlepanes.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{07EF5CA5-5487-4F68-A28B-446A09990724}\WpadNetworkName = "Network 2"	singlepanes.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-ad-a6-79-4d-0d\WpadDecision = "0"	singlepanes.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	singlepanes.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	singlepanes.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	singlepanes.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f003e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	singlepanes.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

singlepanes.exe

pid process

636 singlepanes.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

55073efe1efc561f5355ef68cbe011074ab198c5e4e52fb30e48ac62f64b1a57.exe

pid process

864 55073efe1efc561f5355ef68cbe011074ab198c5e4e52fb30e48ac62f64b1a57.exe

pid	process
636	singlepanes.exe

pid	process
864	55073efe1efc561f5355ef68cbe011074ab198c5e4e52fb30e48ac62f64b1a57.exe

Suspicious use of UnmapMainImage 4 IoCs

Processes:

55073efe1efc561f5355ef68cbe011074ab198c5e4e52fb30e48ac62f64b1a57.exe55073efe1efc561f5355ef68cbe011074ab198c5e4e52fb30e48ac62f64b1a57.exesinglepanes.exesinglepanes.exe

pid	process
1108	55073efe1efc561f5355ef68cbe011074ab198c5e4e52fb30e48ac62f64b1a57.exe
864	55073efe1efc561f5355ef68cbe011074ab198c5e4e52fb30e48ac62f64b1a57.exe
472	singlepanes.exe
636	singlepanes.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

55073efe1efc561f5355ef68cbe011074ab198c5e4e52fb30e48ac62f64b1a57.exesinglepanes.exe

description	pid	process	target process
PID 1108 wrote to memory of 864	1108	55073efe1efc561f5355ef68cbe011074ab198c5e4e52fb30e48ac62f64b1a57.exe	55073efe1efc561f5355ef68cbe011074ab198c5e4e52fb30e48ac62f64b1a57.exe
PID 1108 wrote to memory of 864	1108	55073efe1efc561f5355ef68cbe011074ab198c5e4e52fb30e48ac62f64b1a57.exe	55073efe1efc561f5355ef68cbe011074ab198c5e4e52fb30e48ac62f64b1a57.exe
PID 1108 wrote to memory of 864	1108	55073efe1efc561f5355ef68cbe011074ab198c5e4e52fb30e48ac62f64b1a57.exe	55073efe1efc561f5355ef68cbe011074ab198c5e4e52fb30e48ac62f64b1a57.exe
PID 1108 wrote to memory of 864	1108	55073efe1efc561f5355ef68cbe011074ab198c5e4e52fb30e48ac62f64b1a57.exe	55073efe1efc561f5355ef68cbe011074ab198c5e4e52fb30e48ac62f64b1a57.exe
PID 472 wrote to memory of 636	472	singlepanes.exe	singlepanes.exe
PID 472 wrote to memory of 636	472	singlepanes.exe	singlepanes.exe
PID 472 wrote to memory of 636	472	singlepanes.exe	singlepanes.exe
PID 472 wrote to memory of 636	472	singlepanes.exe	singlepanes.exe

C:\Users\Admin\AppData\Local\Temp\55073efe1efc561f5355ef68cbe011074ab198c5e4e52fb30e48ac62f64b1a57.exe
"C:\Users\Admin\AppData\Local\Temp\55073efe1efc561f5355ef68cbe011074ab198c5e4e52fb30e48ac62f64b1a57.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1108

C:\Users\Admin\AppData\Local\Temp\55073efe1efc561f5355ef68cbe011074ab198c5e4e52fb30e48ac62f64b1a57.exe
--a90dac0d
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:864

C:\Windows\SysWOW64\singlepanes.exe
"C:\Windows\SysWOW64\singlepanes.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:472

C:\Windows\SysWOW64\singlepanes.exe
--c41ec699
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:636

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/636-61-0x0000000000000000-mapping.dmp

Download
memory/636-63-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/636-65-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/864-54-0x0000000000000000-mapping.dmp

Download
memory/864-57-0x00000000002B0000-0x00000000002CB000-memory.dmp

Filesize
108KB

Download
memory/864-58-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/864-59-0x00000000767F1000-0x00000000767F3000-memory.dmp

Filesize
8KB

Download
memory/864-60-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/864-62-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1108-55-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/1108-56-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads