emotet | 1d553ea52f29fcc014b1b9849dcf45e4bec16f480bd2d71825800be012856802

General

Target
sg4IfGk2r2yKyx4zpse01.exe
Size 300KB
Sample200729-92pc5kzfx2
SHA256 1d553ea52f29fcc014b1b9849dcf45e4bec16f480bd2d71825800be012856802
MD5 7e19130efc9f099a18862b773a871d2c
SHA1 19531a9fea6b86484aaa60dd8b8ded704699efab
SHA512 91b54dfb0c9fdce855f0a22525f9b9162b784d2f0e892d9e6a3652487ed7f917eefb9910bba28c84e77b5efdb6a629a5f0c51e0d64f04f8d4f987c659a8cb457
MD5 SHA1 SHA512

Score

10^/10

trojan banker emotet

Malware Config

Extracted

Family

emotet

C2

179.60.229.168:443
185.94.252.13:443
189.218.165.63:80
77.90.136.129:8080
217.199.160.224:7080
104.131.41.185:8080
2.47.112.152:80
185.94.252.27:443
186.250.52.226:8080
51.255.165.160:8080
68.183.170.114:8080
191.99.160.58:80
104.131.103.37:8080
181.31.211.181:80
202.62.39.111:80
83.169.21.32:7080
87.106.46.107:8080
72.47.248.48:7080
177.75.143.112:443
190.17.195.202:80
137.74.106.111:7080
181.129.96.162:8080
82.196.15.205:8080
61.92.159.208:8080
190.6.193.152:8080
181.167.96.215:80
143.0.87.101:80
12.162.84.2:8080
212.71.237.140:8080
217.13.106.14:8080
46.214.11.172:80
114.109.179.60:80
89.32.150.160:8080
185.94.252.12:80
177.72.13.80:80
192.241.146.84:8080
189.1.185.98:8080
187.106.41.99:80
219.92.13.25:80
181.30.69.50:80
68.183.190.199:8080
212.231.60.98:80
190.181.235.46:80
157.7.199.53:8080
178.79.163.131:8080
77.55.211.77:8080
204.225.249.100:7080
170.81.48.2:80
104.236.161.64:8080
5.196.35.138:7080
190.194.242.254:443
50.28.51.143:8080
187.162.248.237:80
46.28.111.142:7080
70.32.84.74:8080
203.25.159.3:8080
190.163.31.26:80
177.144.135.2:80
177.73.0.98:443
177.139.131.143:443
177.74.228.34:80
191.182.6.118:80
94.176.234.118:443
45.161.242.102:80
149.62.173.247:8080
144.139.91.187:443
181.120.79.227:80
80.249.176.206:80
71.50.31.38:80
172.104.169.32:8080
192.241.143.52:8080
111.67.12.221:8080
190.96.118.251:443
186.70.127.199:8090
190.147.137.153:443
177.66.190.130:80
70.32.115.157:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
648	sg4IfGk2r2yKyx4zpse01.exe
648	sg4IfGk2r2yKyx4zpse01.exe
1864	DeviceCenter.exe
1864	DeviceCenter.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
648	sg4IfGk2r2yKyx4zpse01.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 1864	648	sg4IfGk2r2yKyx4zpse01.exe	68
PID 648 wrote to memory of 1864	648	sg4IfGk2r2yKyx4zpse01.exe	68
PID 648 wrote to memory of 1864	648	sg4IfGk2r2yKyx4zpse01.exe	68

Executes dropped EXE 1 IoCs

pid	Process
1864	DeviceCenter.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1864	DeviceCenter.exe
1864	DeviceCenter.exe
1864	DeviceCenter.exe
1864	DeviceCenter.exe

Emotet Payload 2 IoCs

Detects Emotet payload in memory.

resource	yara_rule
behavioral2/memory/648-0-0x0000000002390000-0x000000000239C000-memory.dmp	emotet
behavioral2/memory/1864-3-0x00000000006E0000-0x00000000006EC000-memory.dmp	emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ACCTRES\DeviceCenter.exe	sg4IfGk2r2yKyx4zpse01.exe

C:\Users\Admin\AppData\Local\Temp\sg4IfGk2r2yKyx4zpse01.exe
"C:\Users\Admin\AppData\Local\Temp\sg4IfGk2r2yKyx4zpse01.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
PID:648
- C:\Windows\SysWOW64\ACCTRES\DeviceCenter.exe
  "C:\Windows\SysWOW64\ACCTRES\DeviceCenter.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-0-0x0000000002390000-0x000000000239C000-memory.dmp

Download

memory/1864-3-0x00000000006E0000-0x00000000006EC000-memory.dmp