emotet | c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe
Size

182KB
MD5

bffb4f8200a009590afec2d442d6f9b4
SHA1

fcb42fe77f2babeab8f92bdb63a0d7e98a4b357c
SHA256

c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c
SHA512

f17685a53d1116dcd71a2e51809313e4b1192a48cfcad532e277b452ccd08ad36ce24d9b3d0a3d6cd9e8f22c5699bc7ab1e5db1ce4bfc917090cfd046b2bfeab
SSDEEP

3072:tImQYNtmlphxLDTMcbHjqgm3BS8DVMTZyXBF1pWUy8:tImQY/gp3TPDrm3BpjRF1t

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exec27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exeavgstarted.exeavgstarted.exe

pid	process
3536	c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe
3536	c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe
2004	c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe
2004	c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe
804	avgstarted.exe
804	avgstarted.exe
1300	avgstarted.exe
1300	avgstarted.exe
1300	avgstarted.exe
1300	avgstarted.exe
1300	avgstarted.exe
1300	avgstarted.exe
1300	avgstarted.exe
1300	avgstarted.exe
1300	avgstarted.exe
1300	avgstarted.exe
1300	avgstarted.exe
1300	avgstarted.exe
1300	avgstarted.exe
1300	avgstarted.exe
1300	avgstarted.exe
1300	avgstarted.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe

pid process

2004 c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe

pid	process
2004	c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exeavgstarted.exe

description	pid	process	target process
PID 3536 wrote to memory of 2004	3536	c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe	c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe
PID 3536 wrote to memory of 2004	3536	c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe	c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe
PID 3536 wrote to memory of 2004	3536	c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe	c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe
PID 804 wrote to memory of 1300	804	avgstarted.exe	avgstarted.exe
PID 804 wrote to memory of 1300	804	avgstarted.exe	avgstarted.exe
PID 804 wrote to memory of 1300	804	avgstarted.exe	avgstarted.exe

C:\Users\Admin\AppData\Local\Temp\c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe
"C:\Users\Admin\AppData\Local\Temp\c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3536

C:\Users\Admin\AppData\Local\Temp\c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe
"C:\Users\Admin\AppData\Local\Temp\c27abdb16492b4c1a455a23f243d8b1f9803fc5e754d9474bf155ec96cd58e3c.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2004

C:\Windows\SysWOW64\avgstarted.exe
"C:\Windows\SysWOW64\avgstarted.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:804

C:\Windows\SysWOW64\avgstarted.exe
"C:\Windows\SysWOW64\avgstarted.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1300

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/804-139-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1300-138-0x0000000000000000-mapping.dmp

Download
memory/1300-141-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1300-142-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2004-132-0x0000000000000000-mapping.dmp

Download
memory/2004-135-0x0000000000680000-0x0000000000695000-memory.dmp

Filesize
84KB

Download
memory/2004-137-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2004-140-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3536-133-0x00000000005B0000-0x00000000005C5000-memory.dmp

Filesize
84KB

Download
memory/3536-134-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3536-136-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download