emotet | ac6ff653497ef0da394e6485c2a29b584c602ae1fbed0a5327737e756045cc68

Analysis

max time kernel
143s
max time network
150s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
13/07/2024, 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea3311758ec34992d91b99f8f52c8e9d92b178ad.exe
Size

113KB
MD5

911fb301940678c6720d29dce803b19d
SHA1

ea3311758ec34992d91b99f8f52c8e9d92b178ad
SHA256

23d691ed1bd87d25b2f993d8a0938e72b8e9a92f9688c829bb96475954d21d8b
SHA512

ba78d2866239972543abe78844b710003b6e21edc551ad3e585d8033898c654cda46f55e513b79a69fbbd5f5570dd2348bfd7c2b4f2c8f8eab0048af5b598f6a
SSDEEP

3072:NdXoH140klX/1SvgDJ6gwBq1Dp1xzxfU8R4gj:XYH140ko6JvwA1DpDP4+

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	pinnedlics.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	pinnedlics.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	pinnedlics.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	pinnedlics.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	pinnedlics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	pinnedlics.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	pinnedlics.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	pinnedlics.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2096	pinnedlics.exe
2096	pinnedlics.exe
2096	pinnedlics.exe
2096	pinnedlics.exe
2096	pinnedlics.exe
2096	pinnedlics.exe
2096	pinnedlics.exe
2096	pinnedlics.exe
2096	pinnedlics.exe
2096	pinnedlics.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4428	ea3311758ec34992d91b99f8f52c8e9d92b178ad.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 4428	5020	ea3311758ec34992d91b99f8f52c8e9d92b178ad.exe	71
PID 5020 wrote to memory of 4428	5020	ea3311758ec34992d91b99f8f52c8e9d92b178ad.exe	71
PID 5020 wrote to memory of 4428	5020	ea3311758ec34992d91b99f8f52c8e9d92b178ad.exe	71
PID 4544 wrote to memory of 2096	4544	pinnedlics.exe	73
PID 4544 wrote to memory of 2096	4544	pinnedlics.exe	73
PID 4544 wrote to memory of 2096	4544	pinnedlics.exe	73

C:\Users\Admin\AppData\Local\Temp\ea3311758ec34992d91b99f8f52c8e9d92b178ad.exe
"C:\Users\Admin\AppData\Local\Temp\ea3311758ec34992d91b99f8f52c8e9d92b178ad.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Users\Admin\AppData\Local\Temp\ea3311758ec34992d91b99f8f52c8e9d92b178ad.exe
  --cc55c8b5
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4428

C:\Windows\SysWOW64\pinnedlics.exe
"C:\Windows\SysWOW64\pinnedlics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\SysWOW64\pinnedlics.exe
  --9de45b17
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4428-5-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4428-6-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4428-13-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4544-7-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4544-9-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5020-0-0x0000000002020000-0x0000000002031000-memory.dmp

Filesize
68KB

Download
memory/5020-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5020-4-0x0000000002020000-0x0000000002031000-memory.dmp

Filesize
68KB

Download
memory/5020-3-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download