emotet | a4532a333319600efa847ac6b63b58e855838df70063ceeb58d605f81d223922

General

Target

a4532a333319600efa847ac6b63b58e855838df70063ceeb58d605f81d223922.exe
Size

376KB
MD5

29eedff928b3aa34d5098bedc14290cf
SHA1

b3f7f7bbc77c46786b1c2be629a30c50c440bfd0
SHA256

a4532a333319600efa847ac6b63b58e855838df70063ceeb58d605f81d223922
SHA512

458268173b5778d418c787d344e6c61ef9e26ba67f9b7164fe8b58fc73c9376fe227568d9ebea2763b55509ead86134fb6511af9cadc9a904c02fb9d5a3f9a90

Score

10^/10

trojan banker emotet

Malware Config

Extracted

Family

emotet

C2

186.75.241.230:80

181.143.194.138:443

181.143.53.227:21

85.104.59.244:20

80.11.163.139:443

167.71.10.37:8080

104.131.44.150:8080

185.187.198.15:80

133.167.80.63:7080

198.199.114.69:8080

144.139.247.220:80

152.89.236.214:8080

78.24.219.147:8080

92.222.216.44:8080

46.105.131.87:80

190.226.44.20:21

182.176.132.213:8090

85.54.169.141:8080

192.81.213.192:8080

101.187.237.217:20

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 5 IoCs

Processes:

dasmrccmp.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	dasmrccmp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	dasmrccmp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	dasmrccmp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	dasmrccmp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	dasmrccmp.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

dasmrccmp.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	dasmrccmp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	dasmrccmp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	dasmrccmp.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a4532a333319600efa847ac6b63b58e855838df70063ceeb58d605f81d223922.exedasmrccmp.exe

description	pid	process	target process
PID 2460 wrote to memory of 3876	2460	a4532a333319600efa847ac6b63b58e855838df70063ceeb58d605f81d223922.exe	a4532a333319600efa847ac6b63b58e855838df70063ceeb58d605f81d223922.exe
PID 2460 wrote to memory of 3876	2460	a4532a333319600efa847ac6b63b58e855838df70063ceeb58d605f81d223922.exe	a4532a333319600efa847ac6b63b58e855838df70063ceeb58d605f81d223922.exe
PID 2460 wrote to memory of 3876	2460	a4532a333319600efa847ac6b63b58e855838df70063ceeb58d605f81d223922.exe	a4532a333319600efa847ac6b63b58e855838df70063ceeb58d605f81d223922.exe
PID 3844 wrote to memory of 3912	3844	dasmrccmp.exe	dasmrccmp.exe
PID 3844 wrote to memory of 3912	3844	dasmrccmp.exe	dasmrccmp.exe
PID 3844 wrote to memory of 3912	3844	dasmrccmp.exe	dasmrccmp.exe

Suspicious behavior: EmotetMutantsSpam 2 IoCs

Processes:

a4532a333319600efa847ac6b63b58e855838df70063ceeb58d605f81d223922.exedasmrccmp.exe

pid process

3876 a4532a333319600efa847ac6b63b58e855838df70063ceeb58d605f81d223922.exe
3912 dasmrccmp.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

a4532a333319600efa847ac6b63b58e855838df70063ceeb58d605f81d223922.exe

pid process

3876 a4532a333319600efa847ac6b63b58e855838df70063ceeb58d605f81d223922.exe

pid	process
3876	a4532a333319600efa847ac6b63b58e855838df70063ceeb58d605f81d223922.exe
3912	dasmrccmp.exe

pid	process
3876	a4532a333319600efa847ac6b63b58e855838df70063ceeb58d605f81d223922.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

dasmrccmp.exe

pid	process
3912	dasmrccmp.exe
3912	dasmrccmp.exe
3912	dasmrccmp.exe
3912	dasmrccmp.exe
3912	dasmrccmp.exe
3912	dasmrccmp.exe
3912	dasmrccmp.exe
3912	dasmrccmp.exe
3912	dasmrccmp.exe
3912	dasmrccmp.exe
3912	dasmrccmp.exe
3912	dasmrccmp.exe

C:\Users\Admin\AppData\Local\Temp\a4532a333319600efa847ac6b63b58e855838df70063ceeb58d605f81d223922.exe
"C:\Users\Admin\AppData\Local\Temp\a4532a333319600efa847ac6b63b58e855838df70063ceeb58d605f81d223922.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460

C:\Users\Admin\AppData\Local\Temp\a4532a333319600efa847ac6b63b58e855838df70063ceeb58d605f81d223922.exe
--20e638a1
2⤵
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: RenamesItself
PID:3876

C:\Windows\SysWOW64\dasmrccmp.exe
"C:\Windows\SysWOW64\dasmrccmp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3844

C:\Windows\SysWOW64\dasmrccmp.exe
--2d8627b4
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: EnumeratesProcesses
PID:3912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2460-0-0x00000000005E0000-0x00000000005F4000-memory.dmp

Filesize
80KB

Download
memory/3844-4-0x00000000005C0000-0x00000000005D4000-memory.dmp

Filesize
80KB

Download
memory/3876-1-0x0000000000000000-mapping.dmp

Download
memory/3876-2-0x0000000000470000-0x0000000000484000-memory.dmp

Filesize
80KB

Download
memory/3876-3-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/3912-5-0x0000000000000000-mapping.dmp

Download
memory/3912-7-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads