Analysis
- max time kernel
33s - max time network
38s - platform
windows10-2004_x64 - resource
win10v2004-20240708-en - resource tags
- submitted
08/07/2024, 17:44
General
- Target e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exe
- Size 148KB
- Sample240708-wbbemataph
- SHA256 e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd
Malware Config
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exe"C:\Users\Admin\AppData\Local\Temp\e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exe"C:\Users\Admin\AppData\Local\Temp\e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
-
C:\Windows\SysWOW64\defineresw.exe"C:\Windows\SysWOW64\defineresw.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\defineresw.exe"C:\Windows\SysWOW64\defineresw.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3748-17-0x0000000001080000-0x00000000010A0000-memory.dmp
memory/3748-37-0x0000000001040000-0x000000000105A000-memory.dmp
memory/3748-36-0x0000000000EF0000-0x0000000000F17000-memory.dmp
memory/3748-8-0x0000000000EF0000-0x0000000000F17000-memory.dmp
memory/3748-16-0x0000000001040000-0x000000000105A000-memory.dmp
memory/3748-9-0x0000000001060000-0x000000000107A000-memory.dmp
memory/3748-13-0x0000000001060000-0x000000000107A000-memory.dmp
memory/4808-18-0x0000000000EF0000-0x0000000000F17000-memory.dmp
memory/4808-23-0x00000000016D0000-0x00000000016EA000-memory.dmp
memory/4808-35-0x00000000016B0000-0x00000000016CA000-memory.dmp
memory/4808-34-0x0000000000EF0000-0x0000000000F17000-memory.dmp
memory/4808-24-0x00000000016B0000-0x00000000016CA000-memory.dmp
memory/4808-25-0x0000000001700000-0x0000000001720000-memory.dmp
memory/4808-19-0x00000000016D0000-0x00000000016EA000-memory.dmp
memory/4820-33-0x0000000000EC0000-0x0000000000EE0000-memory.dmp
memory/4820-26-0x0000000000EF0000-0x0000000000F17000-memory.dmp
memory/4820-31-0x0000000000E80000-0x0000000000E9A000-memory.dmp
memory/4820-27-0x0000000000E80000-0x0000000000E9A000-memory.dmp
memory/4820-32-0x0000000000E60000-0x0000000000E7A000-memory.dmp
memory/4820-38-0x0000000000E60000-0x0000000000E7A000-memory.dmp
memory/4956-0-0x0000000000EF0000-0x0000000000F17000-memory.dmp
memory/4956-7-0x0000000002AD0000-0x0000000002AF0000-memory.dmp
memory/4956-6-0x0000000002A90000-0x0000000002AAA000-memory.dmp
memory/4956-14-0x0000000000EF0000-0x0000000000F17000-memory.dmp
memory/4956-15-0x0000000002A90000-0x0000000002AAA000-memory.dmp
memory/4956-5-0x0000000002AB0000-0x0000000002ACA000-memory.dmp
memory/4956-1-0x0000000002AB0000-0x0000000002ACA000-memory.dmp