emotet | 09030fed4da9362dcdd9817e2837ee78927dd17c3cf24abfc7874d278fe67853

Analysis

max time kernel
23s
max time network
32s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
25-06-2024 17:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exe
Size

148KB
MD5

8b0137c27630238d4484e09614e34a6b
SHA1

38cd7b650d6cfa3b3bbdd77462bc77cec81c3e7b
SHA256

e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd
SHA512

8b50aff28fbaca4715139c56c91d3b6361661870d1c36c14495e9786d324cb7ee528fcd6cade38fc07fd305d503910d9099515b384155685139e4a8897bf9899
SSDEEP

3072:RqbvYIHbDHrItpY6QV76ei4cIIZxFtZRrqKWY/svbIbm18Mq:cbvYIL4pY3hi4cLZG8RM

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Drops file in System32 directory 1 IoCs

Processes:

neutraleap.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat neutraleap.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	neutraleap.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exee1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exeneutraleap.exeneutraleap.exe

pid	process
5112	e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exe
5112	e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exe
2316	e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exe
2316	e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exe
1548	neutraleap.exe
1548	neutraleap.exe
3968	neutraleap.exe
3968	neutraleap.exe
3968	neutraleap.exe
3968	neutraleap.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exe

pid process

2316 e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exe

pid	process
2316	e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exeneutraleap.exe

description	pid	process	target process
PID 5112 wrote to memory of 2316	5112	e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exe	e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exe
PID 5112 wrote to memory of 2316	5112	e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exe	e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exe
PID 5112 wrote to memory of 2316	5112	e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exe	e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exe
PID 1548 wrote to memory of 3968	1548	neutraleap.exe	neutraleap.exe
PID 1548 wrote to memory of 3968	1548	neutraleap.exe	neutraleap.exe
PID 1548 wrote to memory of 3968	1548	neutraleap.exe	neutraleap.exe

C:\Users\Admin\AppData\Local\Temp\e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exe
"C:\Users\Admin\AppData\Local\Temp\e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5112

C:\Users\Admin\AppData\Local\Temp\e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exe
"C:\Users\Admin\AppData\Local\Temp\e1f60b891005dfd0f6738444406c8e57d644cc3ce0154f8d17454c886637dfbd.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2316

C:\Windows\SysWOW64\neutraleap.exe
"C:\Windows\SysWOW64\neutraleap.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\SysWOW64\neutraleap.exe
"C:\Windows\SysWOW64\neutraleap.exe"
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3968

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1548-21-0x00000000006B0000-0x00000000006CA000-memory.dmp

Filesize
104KB

Download
memory/1548-29-0x0000000000ED0000-0x0000000000EF7000-memory.dmp

Filesize
156KB

Download
memory/1548-23-0x00000000009C0000-0x00000000009E0000-memory.dmp

Filesize
128KB

Download
memory/1548-22-0x0000000000890000-0x00000000008AA000-memory.dmp

Filesize
104KB

Download
memory/1548-17-0x00000000006B0000-0x00000000006CA000-memory.dmp

Filesize
104KB

Download
memory/2316-33-0x0000000000C50000-0x0000000000C6A000-memory.dmp

Filesize
104KB

Download
memory/2316-32-0x0000000000ED0000-0x0000000000EF7000-memory.dmp

Filesize
156KB

Download
memory/2316-8-0x0000000000E80000-0x0000000000E9A000-memory.dmp

Filesize
104KB

Download
memory/2316-12-0x0000000000E80000-0x0000000000E9A000-memory.dmp

Filesize
104KB

Download
memory/2316-14-0x0000000000EA0000-0x0000000000EC0000-memory.dmp

Filesize
128KB

Download
memory/2316-13-0x0000000000C50000-0x0000000000C6A000-memory.dmp

Filesize
104KB

Download
memory/3968-24-0x0000000001150000-0x000000000116A000-memory.dmp

Filesize
104KB

Download
memory/3968-28-0x0000000001150000-0x000000000116A000-memory.dmp

Filesize
104KB

Download
memory/3968-31-0x0000000001290000-0x00000000012B0000-memory.dmp

Filesize
128KB

Download
memory/3968-30-0x0000000001130000-0x000000000114A000-memory.dmp

Filesize
104KB

Download
memory/5112-16-0x0000000001260000-0x000000000127A000-memory.dmp

Filesize
104KB

Download
memory/5112-15-0x0000000000ED0000-0x0000000000EF7000-memory.dmp

Filesize
156KB

Download
memory/5112-7-0x0000000001390000-0x00000000013B0000-memory.dmp

Filesize
128KB

Download
memory/5112-0-0x0000000000ED0000-0x0000000000EF7000-memory.dmp

Filesize
156KB

Download
memory/5112-2-0x0000000001280000-0x000000000129A000-memory.dmp

Filesize
104KB

Download
memory/5112-6-0x0000000001280000-0x000000000129A000-memory.dmp

Filesize
104KB

Download
memory/5112-1-0x0000000001260000-0x000000000127A000-memory.dmp

Filesize
104KB

Download