emotet | 98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649

General

Target

98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe
Size

138KB
MD5

64746aa2a652f7334ba38422b24e8620
SHA1

d680f22a59d0f4130b0752d0cbb9a0e162939671
SHA256

98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649
SHA512

3196dd23b5605e6a1fc669a9adbae5533640d32152b909270bc9f64ed513d2446404639170c93cdf66e2323f8fe0714e1e75f4438041cef6fed075f11b8d3b61
SSDEEP

3072:gqrvRknb6sxBl0E+R+Bch+l5wJGVTa/pvfM7RCpGe:Z7RcZt9IF6uJkeEs

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

itshotspot.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	itshotspot.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

itshotspot.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	itshotspot.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-b3-7d-48-0d-81\WpadDecisionReason = "1"	itshotspot.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-b3-7d-48-0d-81\WpadDecisionTime = 00b2f2b10d34d901	itshotspot.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	itshotspot.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	itshotspot.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	itshotspot.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	itshotspot.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	itshotspot.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	itshotspot.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CB1AA606-1E40-4F1E-AD52-3B08366C56A9}	itshotspot.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-b3-7d-48-0d-81	itshotspot.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	itshotspot.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CB1AA606-1E40-4F1E-AD52-3B08366C56A9}\WpadDecisionReason = "1"	itshotspot.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CB1AA606-1E40-4F1E-AD52-3B08366C56A9}\WpadDecision = "0"	itshotspot.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CB1AA606-1E40-4F1E-AD52-3B08366C56A9}\WpadNetworkName = "Network 2"	itshotspot.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CB1AA606-1E40-4F1E-AD52-3B08366C56A9}\1e-b3-7d-48-0d-81	itshotspot.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	itshotspot.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	itshotspot.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	itshotspot.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CB1AA606-1E40-4F1E-AD52-3B08366C56A9}\WpadDecisionTime = 00b2f2b10d34d901	itshotspot.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-b3-7d-48-0d-81\WpadDecision = "0"	itshotspot.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

itshotspot.exe

pid process

780 itshotspot.exe
780 itshotspot.exe
780 itshotspot.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe

pid process

852 98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe

pid	process
780	itshotspot.exe
780	itshotspot.exe
780	itshotspot.exe

pid	process
852	98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe

Suspicious use of UnmapMainImage 4 IoCs

Processes:

98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exeitshotspot.exeitshotspot.exe

pid	process
1396	98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe
852	98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe
1748	itshotspot.exe
780	itshotspot.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exeitshotspot.exe

description	pid	process	target process
PID 1396 wrote to memory of 852	1396	98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe	98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe
PID 1396 wrote to memory of 852	1396	98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe	98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe
PID 1396 wrote to memory of 852	1396	98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe	98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe
PID 1396 wrote to memory of 852	1396	98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe	98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe
PID 1748 wrote to memory of 780	1748	itshotspot.exe	itshotspot.exe
PID 1748 wrote to memory of 780	1748	itshotspot.exe	itshotspot.exe
PID 1748 wrote to memory of 780	1748	itshotspot.exe	itshotspot.exe
PID 1748 wrote to memory of 780	1748	itshotspot.exe	itshotspot.exe

C:\Users\Admin\AppData\Local\Temp\98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe
"C:\Users\Admin\AppData\Local\Temp\98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1396

C:\Users\Admin\AppData\Local\Temp\98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe
--42285344
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:852

C:\Windows\SysWOW64\itshotspot.exe
"C:\Windows\SysWOW64\itshotspot.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SysWOW64\itshotspot.exe
--ddda7659
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:780

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/780-59-0x0000000000000000-mapping.dmp

Download
memory/780-61-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/780-63-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/852-54-0x0000000000000000-mapping.dmp

Download
memory/852-57-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/852-58-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download
memory/852-60-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1396-55-0x0000000000220000-0x0000000000231000-memory.dmp

Filesize
68KB

Download
memory/1396-56-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads