emotet | c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c

General

Target

c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe
Size

182KB
MD5

bffb4f8200a009590afec2d442d6f9b4
SHA1

fcb42fe77f2babeab8f92bdb63a0d7e98a4b357c
SHA256

c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c
SHA512

f17685a53d1116dcd71a2e51809313e4b1192a48cfcad532e277b452ccd08ad36ce24d9b3d0a3d6cd9e8f22c5699bc7ab1e5db1ce4bfc917090cfd046b2bfeab
SSDEEP

3072:tImQYNtmlphxLDTMcbHjqgm3BS8DVMTZyXBF1pWUy8:tImQY/gp3TPDrm3BpjRF1t

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

indexerripple.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	indexerripple.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 22 IoCs

Processes:

indexerripple.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	indexerripple.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6AF9610E-C633-4451-B6EC-2075113850DD}\WpadDecisionTime = 80382f290d34d901	indexerripple.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6AF9610E-C633-4451-B6EC-2075113850DD}\WpadDecision = "0"	indexerripple.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6AF9610E-C633-4451-B6EC-2075113850DD}\WpadNetworkName = "Network 2"	indexerripple.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-dc-65-ea-fc-41\WpadDetectedUrl	indexerripple.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	indexerripple.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	indexerripple.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0007000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	indexerripple.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6AF9610E-C633-4451-B6EC-2075113850DD}\WpadDecisionReason = "1"	indexerripple.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-dc-65-ea-fc-41	indexerripple.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6AF9610E-C633-4451-B6EC-2075113850DD}\d6-dc-65-ea-fc-41	indexerripple.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6AF9610E-C633-4451-B6EC-2075113850DD}\WpadDecisionTime = 80921d680d34d901	indexerripple.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-dc-65-ea-fc-41\WpadDecisionTime = 80921d680d34d901	indexerripple.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	indexerripple.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	indexerripple.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	indexerripple.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-dc-65-ea-fc-41\WpadDecisionTime = 80382f290d34d901	indexerripple.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-dc-65-ea-fc-41\WpadDecision = "0"	indexerripple.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	indexerripple.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-dc-65-ea-fc-41\WpadDecisionReason = "1"	indexerripple.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0007000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	indexerripple.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6AF9610E-C633-4451-B6EC-2075113850DD}	indexerripple.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exec27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exeindexerripple.exeindexerripple.exe

pid	process
840	c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe
1300	c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe
668	indexerripple.exe
344	indexerripple.exe
344	indexerripple.exe
344	indexerripple.exe
344	indexerripple.exe
344	indexerripple.exe
344	indexerripple.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe

pid process

1300 c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe

pid	process
1300	c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe

Suspicious use of UnmapMainImage 4 IoCs

Processes:

c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exec27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exeindexerripple.exeindexerripple.exe

pid	process
840	c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe
1300	c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe
668	indexerripple.exe
344	indexerripple.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exeindexerripple.exe

description	pid	process	target process
PID 840 wrote to memory of 1300	840	c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe	c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe
PID 840 wrote to memory of 1300	840	c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe	c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe
PID 840 wrote to memory of 1300	840	c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe	c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe
PID 840 wrote to memory of 1300	840	c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe	c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe
PID 668 wrote to memory of 344	668	indexerripple.exe	indexerripple.exe
PID 668 wrote to memory of 344	668	indexerripple.exe	indexerripple.exe
PID 668 wrote to memory of 344	668	indexerripple.exe	indexerripple.exe
PID 668 wrote to memory of 344	668	indexerripple.exe	indexerripple.exe

C:\Users\Admin\AppData\Local\Temp\c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe
"C:\Users\Admin\AppData\Local\Temp\c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:840

C:\Users\Admin\AppData\Local\Temp\c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe
"C:\Users\Admin\AppData\Local\Temp\c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:1300

C:\Windows\SysWOW64\indexerripple.exe
"C:\Windows\SysWOW64\indexerripple.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:668

C:\Windows\SysWOW64\indexerripple.exe
"C:\Windows\SysWOW64\indexerripple.exe"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:344

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/344-63-0x0000000000000000-mapping.dmp

Download
memory/344-67-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/344-68-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/668-65-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/840-54-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download
memory/840-55-0x0000000000220000-0x0000000000235000-memory.dmp

Filesize
84KB

Download
memory/840-58-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/840-60-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1300-56-0x0000000000000000-mapping.dmp

Download
memory/1300-59-0x0000000000220000-0x0000000000235000-memory.dmp

Filesize
84KB

Download
memory/1300-61-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1300-66-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads