emotet | 37db086d928b34c1f967cfc26b56c48df99d6024be493345880af15f21a453a2

Analysis

max time kernel
75s
max time network
126s
platform
windows10_x64
resource
win10v200722
submitted
09-09-2020 17:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

E2.bin.exe
Size

608KB
MD5

b4b4e2489e8d2bf539e08b7df7d34128
SHA1

46d3f03752809c6f5abf66f17d8562beb60451af
SHA256

37db086d928b34c1f967cfc26b56c48df99d6024be493345880af15f21a453a2
SHA512

d6765bc3ad13e6dac4f22bdae8d27dfcff27dd8cfb33b46820f958e5f8c566439919d9b56d36a50d1c333ad46fe1a9492ef52d049fc94d070344a71cef99c2ab

Score

10^/10

trojan banker emotet

Malware Config

Extracted

Family

emotet

50.91.114.38:80

120.138.30.150:8080

139.59.67.118:443

94.23.216.33:80

107.5.122.110:80

95.213.236.64:8080

84.39.182.7:80

47.144.21.12:443

200.114.213.233:8080

176.111.60.55:8080

70.180.43.7:80

121.124.124.40:7080

113.160.130.116:8443

103.86.49.11:8080

85.105.205.77:8080

174.102.48.180:443

37.187.72.193:8080

189.212.199.126:443

85.152.162.105:80

104.236.246.93:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = acb8f771df86d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

E2.bin.exe

pid process

3940 E2.bin.exe
3940 E2.bin.exe
3940 E2.bin.exe
3940 E2.bin.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

svchost.exe

description pid process

Token: SeShutdownPrivilege 668 svchost.exe
Token: SeCreatePagefilePrivilege 668 svchost.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

E2.bin.exe

pid process

3940 E2.bin.exe

pid	process
3940	E2.bin.exe
3940	E2.bin.exe
3940	E2.bin.exe
3940	E2.bin.exe

description	pid	process
Token: SeShutdownPrivilege	668	svchost.exe
Token: SeCreatePagefilePrivilege	668	svchost.exe

pid	process
3940	E2.bin.exe

C:\Users\Admin\AppData\Local\Temp\E2.bin.exe
"C:\Users\Admin\AppData\Local\Temp\E2.bin.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3940-0-0x0000000000820000-0x0000000000832000-memory.dmp

Filesize
72KB

Download
memory/3940-1-0x00000000022F0000-0x0000000002300000-memory.dmp

Filesize
64KB

Download