emotet | 2032acdf04511314d53f51d1fef7f9e62e69abbe3db0b31a0302a8545ab1bd82

Resubmissions

09/02/2023, 21:39

230209-1hrgmseh81

09/02/2023, 21:36

230209-1f1mjaef6410

Analysis

max time kernel
297s
max time network
304s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
09/02/2023, 21:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2019-05-01-Emotet-binary-retrieved-by-Word-macro.exe
Size 168KB
Sample230209-1f1mjaef64
SHA256 2032acdf04511314d53f51d1fef7f9e62e69abbe3db0b31a0302a8545ab1bd82
MD5 84d164fbfe0982a00404cb3d7b164bf5
SHA1 e068cd94e06c1f592a2d16ac2adc52c2ce506fa5
SHA512 be33a2f96c68ff640a1f59241969fb27971305ecf251c2f8422d3e5a6b0bf609580a7360db3fa3c0355c956f19efec5f7d2f69e947e8f3c979f930ee1761da04
SSDEEP 3072:tzFEhjHHIUjCgArLEZXApH3UHE360ESYUzp8t:1FWHIU2Y9KEHE36FS5p8t
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	typpinned.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	typpinned.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	typpinned.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	typpinned.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	typpinned.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	typpinned.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	typpinned.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3004	typpinned.exe
3004	typpinned.exe
3004	typpinned.exe
3004	typpinned.exe
3004	typpinned.exe
3004	typpinned.exe
3004	typpinned.exe
3004	typpinned.exe
3004	typpinned.exe
3004	typpinned.exe
3004	typpinned.exe
3004	typpinned.exe
3004	typpinned.exe
3004	typpinned.exe
3004	typpinned.exe
3004	typpinned.exe
3004	typpinned.exe
3004	typpinned.exe
3004	typpinned.exe
3004	typpinned.exe
3004	typpinned.exe
3004	typpinned.exe
3004	typpinned.exe
3004	typpinned.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5024	2019-05-01-Emotet-binary-retrieved-by-Word-macro.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 5024	4956	2019-05-01-Emotet-binary-retrieved-by-Word-macro.exe	81
PID 4956 wrote to memory of 5024	4956	2019-05-01-Emotet-binary-retrieved-by-Word-macro.exe	81
PID 4956 wrote to memory of 5024	4956	2019-05-01-Emotet-binary-retrieved-by-Word-macro.exe	81
PID 444 wrote to memory of 3004	444	typpinned.exe	83
PID 444 wrote to memory of 3004	444	typpinned.exe	83
PID 444 wrote to memory of 3004	444	typpinned.exe	83

C:\Users\Admin\AppData\Local\Temp\2019-05-01-Emotet-binary-retrieved-by-Word-macro.exe
"C:\Users\Admin\AppData\Local\Temp\2019-05-01-Emotet-binary-retrieved-by-Word-macro.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Users\Admin\AppData\Local\Temp\2019-05-01-Emotet-binary-retrieved-by-Word-macro.exe
  --6dea9298
  2⤵
  - Suspicious behavior: RenamesItself
  PID:5024

C:\Windows\SysWOW64\typpinned.exe
"C:\Windows\SysWOW64\typpinned.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:444
- C:\Windows\SysWOW64\typpinned.exe
  --fa134e99
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3004-140-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3004-141-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4956-132-0x0000000000580000-0x0000000000591000-memory.dmp

Download

memory/4956-133-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4956-135-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5024-136-0x0000000000460000-0x0000000000471000-memory.dmp

Download

memory/5024-137-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/5024-139-0x0000000000400000-0x0000000000414000-memory.dmp

Download