emotet | bdef76fad180d81d1ac91576c1dd44423a64c836db08c5e985282ab7b55ace01

Analysis

max time kernel
75s
max time network
130s
platform
windows10_x64
resource
win10v200722
submitted
09-09-2020 17:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

E1.bin.exe
Size

608KB
MD5

854b2fc809ee3432366f0a3ebad48f9f
SHA1

c0fa1cdbd8412635b4ea1753895fc0dda0af95a4
SHA256

bdef76fad180d81d1ac91576c1dd44423a64c836db08c5e985282ab7b55ace01
SHA512

add3c3cfffbcc386fa0116afefc1cc7fbcde5479e3dd1b10b79afc01b7a75d8a2b8ee180ca1fbcd6aa50d23b78d04a5afecb535a29636e84d934708efb871ee5

Score

10^/10

trojan banker emotet

Malware Config

Extracted

Family

emotet

74.136.144.133:80

51.38.124.206:80

178.79.163.131:8080

82.196.15.205:8080

212.71.237.140:8080

67.247.242.247:80

87.106.46.107:8080

104.131.103.37:8080

83.169.21.32:7080

45.161.242.102:80

110.142.219.51:80

45.173.88.33:80

187.162.248.237:80

5.196.35.138:7080

72.47.248.48:7080

186.103.141.250:443

98.13.75.196:80

77.90.136.129:8080

186.70.127.199:8090

152.169.22.67:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = b7c05f5fdf86d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

E1.bin.exe

pid process

2080 E1.bin.exe
2080 E1.bin.exe
2080 E1.bin.exe
2080 E1.bin.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

svchost.exe

description pid process

Token: SeShutdownPrivilege 3076 svchost.exe
Token: SeCreatePagefilePrivilege 3076 svchost.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

E1.bin.exe

pid process

2080 E1.bin.exe

pid	process
2080	E1.bin.exe
2080	E1.bin.exe
2080	E1.bin.exe
2080	E1.bin.exe

description	pid	process
Token: SeShutdownPrivilege	3076	svchost.exe
Token: SeCreatePagefilePrivilege	3076	svchost.exe

pid	process
2080	E1.bin.exe

C:\Users\Admin\AppData\Local\Temp\E1.bin.exe
"C:\Users\Admin\AppData\Local\Temp\E1.bin.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2080-0-0x00000000022C0000-0x00000000022D2000-memory.dmp

Filesize
72KB

Download
memory/2080-1-0x00000000022F0000-0x0000000002300000-memory.dmp

Filesize
64KB

Download