emotet | f86a2882452a6a3b7c33a7a5b7a7e129631dd6cef8b70412e4b7e0fb4da8e659

General

Target

emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe
Size

664KB
MD5

7ae377da1d45f77d9e48442ae6a11a54
SHA1

62a9d9f8c2df3232303d421fa325c5ca359a4b7a
SHA256

f86a2882452a6a3b7c33a7a5b7a7e129631dd6cef8b70412e4b7e0fb4da8e659
SHA512

c66b1c453172699e3e67c1af267fd2bc4b6880cfe7ba07bf66e259f6d4d0542633de259cf48a73d2e971492cfb01a9f249359bd49154a382b3e7b953752539b6

Score

10^/10

trojan banker emotet

Malware Config

Extracted

Family

emotet

C2

24.181.125.62:80

98.156.206.153:80

173.21.26.90:80

108.61.99.179:8080

165.227.156.155:443

159.69.89.130:8080

167.99.105.223:7080

5.196.74.210:8080

200.7.243.108:443

183.102.238.69:465

64.147.15.138:80

85.152.174.56:80

59.148.227.190:80

62.75.187.192:8080

174.77.190.137:8080

87.106.139.101:8080

173.247.19.238:80

2.38.99.79:80

178.210.51.222:8080

209.141.54.221:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	footerinbox.exe

Modifies data under HKEY_USERS 21 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	footerinbox.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	footerinbox.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	footerinbox.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadDecisionReason = "1"	footerinbox.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadDecisionTime = 70bb39c9ec9fd601	footerinbox.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0"	footerinbox.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	footerinbox.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	footerinbox.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadDecision = "0"	footerinbox.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadNetworkName = "Network"	footerinbox.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77	footerinbox.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	footerinbox.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	footerinbox.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	footerinbox.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}	footerinbox.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 70bb39c9ec9fd601	footerinbox.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	footerinbox.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	footerinbox.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070013000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	footerinbox.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\32-e2-17-db-d2-77	footerinbox.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1"	footerinbox.exe

Suspicious behavior: EmotetMutantsSpam 2 IoCs

pid	Process
1176	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe
1904	footerinbox.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1904	footerinbox.exe
1904	footerinbox.exe
1904	footerinbox.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1176	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1156	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe
1156	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe
1176	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe
1176	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe
1576	footerinbox.exe
1576	footerinbox.exe
1904	footerinbox.exe
1904	footerinbox.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 1176	1156	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe	25
PID 1156 wrote to memory of 1176	1156	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe	25
PID 1156 wrote to memory of 1176	1156	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe	25
PID 1156 wrote to memory of 1176	1156	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe	25
PID 1576 wrote to memory of 1904	1576	footerinbox.exe	30
PID 1576 wrote to memory of 1904	1576	footerinbox.exe	30
PID 1576 wrote to memory of 1904	1576	footerinbox.exe	30
PID 1576 wrote to memory of 1904	1576	footerinbox.exe	30

C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe
"C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe
  --a1505d41
  2⤵
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  PID:1176

C:\Windows\SysWOW64\footerinbox.exe
"C:\Windows\SysWOW64\footerinbox.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\SysWOW64\footerinbox.exe
  --acacf501
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1156-0-0x0000000000290000-0x00000000002A7000-memory.dmp

Filesize
92KB

Download
memory/1176-2-0x00000000003B0000-0x00000000003C7000-memory.dmp

Filesize
92KB

Download
memory/1176-3-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/1576-4-0x00000000004F0000-0x0000000000507000-memory.dmp

Filesize
92KB

Download
memory/1904-6-0x0000000000530000-0x0000000000547000-memory.dmp

Filesize
92KB

Download
memory/1904-7-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download

Analysis

Sharing