emotet | 3df87edaa5283ac998d421713e3809b1e1d9c5d922ec46feb68eaf09c253ef16

General

Target

3df87edaa5283ac998d421713e3809b1e1d9c5d922ec46feb68eaf09c253ef16.exe
Size

76KB
MD5

bd636698c021a83253c657f7f0c3d9fc
SHA1

6d685e92fe183f66a853103c9db9e9367def8801
SHA256

3df87edaa5283ac998d421713e3809b1e1d9c5d922ec46feb68eaf09c253ef16
SHA512

eef841d92dcbe040d933211deca16bf0890767cad2bc4b301045113c01439d375cb81116b44d6db4d1c4fdf34aed7a23e8f9f67005b05d3fa7bbec469017272c
SSDEEP

1536:c9PAWuSou72/qFDq3pnZ/jEX8vBa9/a/IQZu0DD+S:cG/SR7nW5nZ/AX8v087y

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

implviewer.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	implviewer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

implviewer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4917772D-CF6C-4CF6-A6D7-8946A8878649}\WpadDecision = "0"	implviewer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	implviewer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0014000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	implviewer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4917772D-CF6C-4CF6-A6D7-8946A8878649}\WpadDecisionTime = e03f78a48706d901	implviewer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-b2-ad-6b-7a-8c\WpadDecisionReason = "1"	implviewer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-b2-ad-6b-7a-8c\WpadDecisionTime = e03f78a48706d901	implviewer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-b2-ad-6b-7a-8c\WpadDecision = "0"	implviewer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	implviewer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4917772D-CF6C-4CF6-A6D7-8946A8878649}\WpadNetworkName = "Network 2"	implviewer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-b2-ad-6b-7a-8c	implviewer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4917772D-CF6C-4CF6-A6D7-8946A8878649}	implviewer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	implviewer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	implviewer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	implviewer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	implviewer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	implviewer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4917772D-CF6C-4CF6-A6D7-8946A8878649}\WpadDecisionReason = "1"	implviewer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4917772D-CF6C-4CF6-A6D7-8946A8878649}\7e-b2-ad-6b-7a-8c	implviewer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	implviewer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	implviewer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	implviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

implviewer.exe

pid process

1376 implviewer.exe
1376 implviewer.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

3df87edaa5283ac998d421713e3809b1e1d9c5d922ec46feb68eaf09c253ef16.exe

pid process

1144 3df87edaa5283ac998d421713e3809b1e1d9c5d922ec46feb68eaf09c253ef16.exe

pid	process
1376	implviewer.exe
1376	implviewer.exe

pid	process
1144	3df87edaa5283ac998d421713e3809b1e1d9c5d922ec46feb68eaf09c253ef16.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

3df87edaa5283ac998d421713e3809b1e1d9c5d922ec46feb68eaf09c253ef16.exeimplviewer.exe

description	pid	process	target process
PID 976 wrote to memory of 1144	976	3df87edaa5283ac998d421713e3809b1e1d9c5d922ec46feb68eaf09c253ef16.exe	3df87edaa5283ac998d421713e3809b1e1d9c5d922ec46feb68eaf09c253ef16.exe
PID 976 wrote to memory of 1144	976	3df87edaa5283ac998d421713e3809b1e1d9c5d922ec46feb68eaf09c253ef16.exe	3df87edaa5283ac998d421713e3809b1e1d9c5d922ec46feb68eaf09c253ef16.exe
PID 976 wrote to memory of 1144	976	3df87edaa5283ac998d421713e3809b1e1d9c5d922ec46feb68eaf09c253ef16.exe	3df87edaa5283ac998d421713e3809b1e1d9c5d922ec46feb68eaf09c253ef16.exe
PID 976 wrote to memory of 1144	976	3df87edaa5283ac998d421713e3809b1e1d9c5d922ec46feb68eaf09c253ef16.exe	3df87edaa5283ac998d421713e3809b1e1d9c5d922ec46feb68eaf09c253ef16.exe
PID 808 wrote to memory of 1376	808	implviewer.exe	implviewer.exe
PID 808 wrote to memory of 1376	808	implviewer.exe	implviewer.exe
PID 808 wrote to memory of 1376	808	implviewer.exe	implviewer.exe
PID 808 wrote to memory of 1376	808	implviewer.exe	implviewer.exe

C:\Users\Admin\AppData\Local\Temp\3df87edaa5283ac998d421713e3809b1e1d9c5d922ec46feb68eaf09c253ef16.exe
"C:\Users\Admin\AppData\Local\Temp\3df87edaa5283ac998d421713e3809b1e1d9c5d922ec46feb68eaf09c253ef16.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:976

C:\Users\Admin\AppData\Local\Temp\3df87edaa5283ac998d421713e3809b1e1d9c5d922ec46feb68eaf09c253ef16.exe
--91939210
2⤵
- Suspicious behavior: RenamesItself
PID:1144

C:\Windows\SysWOW64\implviewer.exe
"C:\Windows\SysWOW64\implviewer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\SysWOW64\implviewer.exe
--b169164
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1376

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/976-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/976-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1144-56-0x0000000000000000-mapping.dmp

Download
memory/1376-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads