emotet | 2032acdf04511314d53f51d1fef7f9e62e69abbe3db0b31a0302a8545ab1bd82

Resubmissions

14/02/2023, 23:20

230214-3be65sgg96

14/02/2023, 23:19

230214-3a128agg9510

Analysis

max time kernel
128s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2023, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2019-05-01-Emotet-binary-retrieved-by-Word-macro.exe
Size 168KB
Sample230214-3a128agg95
SHA256 2032acdf04511314d53f51d1fef7f9e62e69abbe3db0b31a0302a8545ab1bd82
MD5 84d164fbfe0982a00404cb3d7b164bf5
SHA1 e068cd94e06c1f592a2d16ac2adc52c2ce506fa5
SHA512 be33a2f96c68ff640a1f59241969fb27971305ecf251c2f8422d3e5a6b0bf609580a7360db3fa3c0355c956f19efec5f7d2f69e947e8f3c979f930ee1761da04
SSDEEP 3072:tzFEhjHHIUjCgArLEZXApH3UHE360ESYUzp8t:1FWHIU2Y9KEHE36FS5p8t
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	prompthotspot.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	prompthotspot.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	prompthotspot.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	prompthotspot.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	prompthotspot.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	prompthotspot.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	prompthotspot.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4344	prompthotspot.exe
4344	prompthotspot.exe
4344	prompthotspot.exe
4344	prompthotspot.exe
4344	prompthotspot.exe
4344	prompthotspot.exe
4344	prompthotspot.exe
4344	prompthotspot.exe
4344	prompthotspot.exe
4344	prompthotspot.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5004	2019-05-01-Emotet-binary-retrieved-by-Word-macro.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 5004	4796	2019-05-01-Emotet-binary-retrieved-by-Word-macro.exe	81
PID 4796 wrote to memory of 5004	4796	2019-05-01-Emotet-binary-retrieved-by-Word-macro.exe	81
PID 4796 wrote to memory of 5004	4796	2019-05-01-Emotet-binary-retrieved-by-Word-macro.exe	81
PID 2416 wrote to memory of 4344	2416	prompthotspot.exe	86
PID 2416 wrote to memory of 4344	2416	prompthotspot.exe	86
PID 2416 wrote to memory of 4344	2416	prompthotspot.exe	86

C:\Users\Admin\AppData\Local\Temp\2019-05-01-Emotet-binary-retrieved-by-Word-macro.exe
"C:\Users\Admin\AppData\Local\Temp\2019-05-01-Emotet-binary-retrieved-by-Word-macro.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\2019-05-01-Emotet-binary-retrieved-by-Word-macro.exe
  --6dea9298
  2⤵
  - Suspicious behavior: RenamesItself
  PID:5004

C:\Windows\SysWOW64\prompthotspot.exe
"C:\Windows\SysWOW64\prompthotspot.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\prompthotspot.exe
  --66c2d221
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4344-139-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4344-140-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4796-132-0x0000000002160000-0x0000000002171000-memory.dmp

Download

memory/4796-134-0x0000000002160000-0x0000000002171000-memory.dmp

Download

memory/4796-135-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5004-136-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/5004-138-0x0000000000400000-0x0000000000414000-memory.dmp

Download