emotet | ac6ff653497ef0da394e6485c2a29b584c602ae1fbed0a5327737e756045cc68

Analysis

max time kernel
149s
max time network
157s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
13-07-2024 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5ad2b2fe9ae9b79559199e35a3d6f2c5e01f9be.exe
Size

112KB
MD5

794f1c82761440dbb2e00fbe8fc420d3
SHA1

e5ad2b2fe9ae9b79559199e35a3d6f2c5e01f9be
SHA256

05e1cd9e4504a8fa1e85596c8dd26c370f4751439b407a1230e3a26680b44cce
SHA512

8f7fc8e2e0e2fe51864fa46cd8b6e00440091720c4e05d757ca4e892dc12d31d4dc2be67ff1d534ca8ba6105a11b79a228c60ec1c2f8564d7c0b690d0cf3669e
SSDEEP

3072:NdXoH140klX/1SvgDJ6gwBq1Dp1xzxfU8R4gL:XYH140ko6JvwA1DpDP44

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 5 IoCs

Processes:

soundcomment.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	soundcomment.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	soundcomment.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	soundcomment.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	soundcomment.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	soundcomment.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

soundcomment.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	soundcomment.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	soundcomment.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	soundcomment.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

soundcomment.exe

pid	process
5096	soundcomment.exe
5096	soundcomment.exe
5096	soundcomment.exe
5096	soundcomment.exe
5096	soundcomment.exe
5096	soundcomment.exe
5096	soundcomment.exe
5096	soundcomment.exe
5096	soundcomment.exe
5096	soundcomment.exe
5096	soundcomment.exe
5096	soundcomment.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

e5ad2b2fe9ae9b79559199e35a3d6f2c5e01f9be.exe

pid process

2444 e5ad2b2fe9ae9b79559199e35a3d6f2c5e01f9be.exe

pid	process
2444	e5ad2b2fe9ae9b79559199e35a3d6f2c5e01f9be.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

e5ad2b2fe9ae9b79559199e35a3d6f2c5e01f9be.exesoundcomment.exe

description	pid	process	target process
PID 3016 wrote to memory of 2444	3016	e5ad2b2fe9ae9b79559199e35a3d6f2c5e01f9be.exe	e5ad2b2fe9ae9b79559199e35a3d6f2c5e01f9be.exe
PID 3016 wrote to memory of 2444	3016	e5ad2b2fe9ae9b79559199e35a3d6f2c5e01f9be.exe	e5ad2b2fe9ae9b79559199e35a3d6f2c5e01f9be.exe
PID 3016 wrote to memory of 2444	3016	e5ad2b2fe9ae9b79559199e35a3d6f2c5e01f9be.exe	e5ad2b2fe9ae9b79559199e35a3d6f2c5e01f9be.exe
PID 3576 wrote to memory of 5096	3576	soundcomment.exe	soundcomment.exe
PID 3576 wrote to memory of 5096	3576	soundcomment.exe	soundcomment.exe
PID 3576 wrote to memory of 5096	3576	soundcomment.exe	soundcomment.exe

C:\Users\Admin\AppData\Local\Temp\e5ad2b2fe9ae9b79559199e35a3d6f2c5e01f9be.exe
"C:\Users\Admin\AppData\Local\Temp\e5ad2b2fe9ae9b79559199e35a3d6f2c5e01f9be.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3016

C:\Users\Admin\AppData\Local\Temp\e5ad2b2fe9ae9b79559199e35a3d6f2c5e01f9be.exe
--6556ea49
2⤵
- Suspicious behavior: RenamesItself
PID:2444

C:\Windows\SysWOW64\soundcomment.exe
"C:\Windows\SysWOW64\soundcomment.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3576

C:\Windows\SysWOW64\soundcomment.exe
--1e570902
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2444-5-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2444-9-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3016-0-0x0000000002010000-0x0000000002021000-memory.dmp

Filesize
68KB

Download
memory/3016-4-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3016-3-0x0000000002010000-0x0000000002021000-memory.dmp

Filesize
68KB

Download
memory/3576-6-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download