emotet | aaf1535f58bb803f3bf3fcab509cd982c16b230b9e15485424f16fce62fe7ed0

General

Target

aaf1535f58bb803f3bf3fcab509cd982c16b230b9e15485424f16fce62fe7ed0.exe
Size

233KB
MD5

ec4c70f038832769278a1a94ed8fb44e
SHA1

3e01f1609f1e9edd0ec9ddc874aad4d830fcec13
SHA256

aaf1535f58bb803f3bf3fcab509cd982c16b230b9e15485424f16fce62fe7ed0
SHA512

ae137caea7739f8c4b224b98db719ae4f2858e945f554ee8ddecec7212f2c711af0a99d9f9728a49333e8f99b4b0f9791fa5c0ab8f380788e18f7cebab4ca3cb
SSDEEP

3072:4JGbF2ny0ViOfTOp3ORLYkGQXOa+8ZpDySU7fqMvUC1XAEuwkil0WtapmOgC9RPj:/MnyK/TTZEhvUCh0iIpVRPbkZ9rVBM

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

ipropwithout.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	ipropwithout.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

ipropwithout.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	ipropwithout.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ipropwithout.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0E9FDD27-67A2-425A-B077-21E86540AEBF}	ipropwithout.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0E9FDD27-67A2-425A-B077-21E86540AEBF}\WpadDecision = "0"	ipropwithout.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-35-43-9f-c0-27	ipropwithout.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-35-43-9f-c0-27\WpadDecisionReason = "1"	ipropwithout.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-35-43-9f-c0-27\WpadDecisionTime = f09eafd81534d901	ipropwithout.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	ipropwithout.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ipropwithout.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	ipropwithout.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0E9FDD27-67A2-425A-B077-21E86540AEBF}\WpadNetworkName = "Network 3"	ipropwithout.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ipropwithout.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	ipropwithout.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	ipropwithout.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0E9FDD27-67A2-425A-B077-21E86540AEBF}\WpadDecisionReason = "1"	ipropwithout.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-35-43-9f-c0-27\WpadDecision = "0"	ipropwithout.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ipropwithout.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	ipropwithout.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0099000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ipropwithout.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0E9FDD27-67A2-425A-B077-21E86540AEBF}\WpadDecisionTime = f09eafd81534d901	ipropwithout.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0E9FDD27-67A2-425A-B077-21E86540AEBF}\3a-35-43-9f-c0-27	ipropwithout.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

ipropwithout.exe

pid process

1936 ipropwithout.exe
1936 ipropwithout.exe
1936 ipropwithout.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

aaf1535f58bb803f3bf3fcab509cd982c16b230b9e15485424f16fce62fe7ed0.exe

pid process

1772 aaf1535f58bb803f3bf3fcab509cd982c16b230b9e15485424f16fce62fe7ed0.exe

pid	process
1936	ipropwithout.exe
1936	ipropwithout.exe
1936	ipropwithout.exe

pid	process
1772	aaf1535f58bb803f3bf3fcab509cd982c16b230b9e15485424f16fce62fe7ed0.exe

Suspicious use of UnmapMainImage 4 IoCs

Processes:

aaf1535f58bb803f3bf3fcab509cd982c16b230b9e15485424f16fce62fe7ed0.exeaaf1535f58bb803f3bf3fcab509cd982c16b230b9e15485424f16fce62fe7ed0.exeipropwithout.exeipropwithout.exe

pid	process
1720	aaf1535f58bb803f3bf3fcab509cd982c16b230b9e15485424f16fce62fe7ed0.exe
1772	aaf1535f58bb803f3bf3fcab509cd982c16b230b9e15485424f16fce62fe7ed0.exe
904	ipropwithout.exe
1936	ipropwithout.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

aaf1535f58bb803f3bf3fcab509cd982c16b230b9e15485424f16fce62fe7ed0.exeipropwithout.exe

description	pid	process	target process
PID 1720 wrote to memory of 1772	1720	aaf1535f58bb803f3bf3fcab509cd982c16b230b9e15485424f16fce62fe7ed0.exe	aaf1535f58bb803f3bf3fcab509cd982c16b230b9e15485424f16fce62fe7ed0.exe
PID 1720 wrote to memory of 1772	1720	aaf1535f58bb803f3bf3fcab509cd982c16b230b9e15485424f16fce62fe7ed0.exe	aaf1535f58bb803f3bf3fcab509cd982c16b230b9e15485424f16fce62fe7ed0.exe
PID 1720 wrote to memory of 1772	1720	aaf1535f58bb803f3bf3fcab509cd982c16b230b9e15485424f16fce62fe7ed0.exe	aaf1535f58bb803f3bf3fcab509cd982c16b230b9e15485424f16fce62fe7ed0.exe
PID 1720 wrote to memory of 1772	1720	aaf1535f58bb803f3bf3fcab509cd982c16b230b9e15485424f16fce62fe7ed0.exe	aaf1535f58bb803f3bf3fcab509cd982c16b230b9e15485424f16fce62fe7ed0.exe
PID 904 wrote to memory of 1936	904	ipropwithout.exe	ipropwithout.exe
PID 904 wrote to memory of 1936	904	ipropwithout.exe	ipropwithout.exe
PID 904 wrote to memory of 1936	904	ipropwithout.exe	ipropwithout.exe
PID 904 wrote to memory of 1936	904	ipropwithout.exe	ipropwithout.exe

C:\Users\Admin\AppData\Local\Temp\aaf1535f58bb803f3bf3fcab509cd982c16b230b9e15485424f16fce62fe7ed0.exe
"C:\Users\Admin\AppData\Local\Temp\aaf1535f58bb803f3bf3fcab509cd982c16b230b9e15485424f16fce62fe7ed0.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1720

C:\Users\Admin\AppData\Local\Temp\aaf1535f58bb803f3bf3fcab509cd982c16b230b9e15485424f16fce62fe7ed0.exe
--bcc5c36e
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:1772

C:\Windows\SysWOW64\ipropwithout.exe
"C:\Windows\SysWOW64\ipropwithout.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:904

C:\Windows\SysWOW64\ipropwithout.exe
--642bf7ee
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1936

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-55-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/1720-56-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1772-54-0x0000000000000000-mapping.dmp

Download
memory/1772-57-0x0000000000220000-0x000000000023B000-memory.dmp

Filesize
108KB

Download
memory/1772-58-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1772-59-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download
memory/1772-61-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1936-60-0x0000000000000000-mapping.dmp

Download
memory/1936-62-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1936-64-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads