emotet | f86a2882452a6a3b7c33a7a5b7a7e129631dd6cef8b70412e4b7e0fb4da8e659

General

Target

emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe
Size

664KB
MD5

7ae377da1d45f77d9e48442ae6a11a54
SHA1

62a9d9f8c2df3232303d421fa325c5ca359a4b7a
SHA256

f86a2882452a6a3b7c33a7a5b7a7e129631dd6cef8b70412e4b7e0fb4da8e659
SHA512

c66b1c453172699e3e67c1af267fd2bc4b6880cfe7ba07bf66e259f6d4d0542633de259cf48a73d2e971492cfb01a9f249359bd49154a382b3e7b953752539b6

Score

10^/10

trojan banker emotet

Malware Config

Extracted

Family

emotet

C2

24.181.125.62:80

98.156.206.153:80

173.21.26.90:80

108.61.99.179:8080

165.227.156.155:443

159.69.89.130:8080

167.99.105.223:7080

5.196.74.210:8080

200.7.243.108:443

183.102.238.69:465

64.147.15.138:80

85.152.174.56:80

59.148.227.190:80

62.75.187.192:8080

174.77.190.137:8080

87.106.139.101:8080

173.247.19.238:80

2.38.99.79:80

178.210.51.222:8080

209.141.54.221:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	scanzap.exe

Modifies data under HKEY_USERS 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	scanzap.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}	scanzap.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1"	scanzap.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 1072f8bdec9fd601	scanzap.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07000d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	scanzap.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadDecisionTime = 1072f8bdec9fd601	scanzap.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadNetworkName = "Network"	scanzap.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	scanzap.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	scanzap.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	scanzap.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	scanzap.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0"	scanzap.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	scanzap.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	scanzap.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadDecisionReason = "1"	scanzap.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77	scanzap.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\32-e2-17-db-d2-77	scanzap.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	scanzap.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	scanzap.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	scanzap.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadDecision = "0"	scanzap.exe

Suspicious behavior: EmotetMutantsSpam 2 IoCs

pid	Process
1036	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe
1608	scanzap.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1608	scanzap.exe
1608	scanzap.exe
1608	scanzap.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1036	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1124	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe
1124	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe
1036	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe
1036	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe
1568	scanzap.exe
1568	scanzap.exe
1608	scanzap.exe
1608	scanzap.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1036	1124	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe	25
PID 1124 wrote to memory of 1036	1124	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe	25
PID 1124 wrote to memory of 1036	1124	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe	25
PID 1124 wrote to memory of 1036	1124	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe	25
PID 1568 wrote to memory of 1608	1568	scanzap.exe	30
PID 1568 wrote to memory of 1608	1568	scanzap.exe	30
PID 1568 wrote to memory of 1608	1568	scanzap.exe	30
PID 1568 wrote to memory of 1608	1568	scanzap.exe	30

C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe
"C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe
  --a1505d41
  2⤵
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  PID:1036

C:\Windows\SysWOW64\scanzap.exe
"C:\Windows\SysWOW64\scanzap.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\SysWOW64\scanzap.exe
  --3fbaf42
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1036-2-0x00000000003D0000-0x00000000003E7000-memory.dmp

Filesize
92KB

Download
memory/1036-3-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/1124-0-0x0000000000290000-0x00000000002A7000-memory.dmp

Filesize
92KB

Download
memory/1608-6-0x00000000003E0000-0x00000000003F7000-memory.dmp

Filesize
92KB

Download
memory/1608-7-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download

Analysis

Sharing