emotet | 98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649

Analysis

max time kernel
133s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe
Size

138KB
MD5

64746aa2a652f7334ba38422b24e8620
SHA1

d680f22a59d0f4130b0752d0cbb9a0e162939671
SHA256

98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649
SHA512

3196dd23b5605e6a1fc669a9adbae5533640d32152b909270bc9f64ed513d2446404639170c93cdf66e2323f8fe0714e1e75f4438041cef6fed075f11b8d3b61
SSDEEP

3072:gqrvRknb6sxBl0E+R+Bch+l5wJGVTa/pvfM7RCpGe:Z7RcZt9IF6uJkeEs

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

slidesitka.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	slidesitka.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	slidesitka.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	slidesitka.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	slidesitka.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

slidesitka.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	slidesitka.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	slidesitka.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	slidesitka.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

slidesitka.exe

pid	process
2848	slidesitka.exe
2848	slidesitka.exe
2848	slidesitka.exe
2848	slidesitka.exe
2848	slidesitka.exe
2848	slidesitka.exe
2848	slidesitka.exe
2848	slidesitka.exe
2848	slidesitka.exe
2848	slidesitka.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe

pid process

3440 98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe

pid	process
3440	98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exeslidesitka.exe

description	pid	process	target process
PID 4664 wrote to memory of 3440	4664	98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe	98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe
PID 4664 wrote to memory of 3440	4664	98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe	98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe
PID 4664 wrote to memory of 3440	4664	98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe	98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe
PID 2548 wrote to memory of 2848	2548	slidesitka.exe	slidesitka.exe
PID 2548 wrote to memory of 2848	2548	slidesitka.exe	slidesitka.exe
PID 2548 wrote to memory of 2848	2548	slidesitka.exe	slidesitka.exe

C:\Users\Admin\AppData\Local\Temp\98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe
"C:\Users\Admin\AppData\Local\Temp\98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4664

C:\Users\Admin\AppData\Local\Temp\98b08a240f557676289bbcfeaba2d48b43c57a9613414fe91075a655af534649.exe
--42285344
2⤵
- Suspicious behavior: RenamesItself
PID:3440

C:\Windows\SysWOW64\slidesitka.exe
"C:\Windows\SysWOW64\slidesitka.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548

C:\Windows\SysWOW64\slidesitka.exe
--ab64df55
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2848

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2848-137-0x0000000000000000-mapping.dmp

Download
memory/2848-139-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2848-140-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3440-133-0x0000000000000000-mapping.dmp

Download
memory/3440-136-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3440-138-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4664-132-0x00000000005C0000-0x00000000005D1000-memory.dmp

Filesize
68KB

Download
memory/4664-134-0x00000000005C0000-0x00000000005D1000-memory.dmp

Filesize
68KB

Download
memory/4664-135-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download