emotet | f86a2882452a6a3b7c33a7a5b7a7e129631dd6cef8b70412e4b7e0fb4da8e659

General

Target

emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe
Size

664KB
MD5

7ae377da1d45f77d9e48442ae6a11a54
SHA1

62a9d9f8c2df3232303d421fa325c5ca359a4b7a
SHA256

f86a2882452a6a3b7c33a7a5b7a7e129631dd6cef8b70412e4b7e0fb4da8e659
SHA512

c66b1c453172699e3e67c1af267fd2bc4b6880cfe7ba07bf66e259f6d4d0542633de259cf48a73d2e971492cfb01a9f249359bd49154a382b3e7b953752539b6

Score

10^/10

trojan banker emotet

Malware Config

Extracted

Family

emotet

C2

24.181.125.62:80

98.156.206.153:80

173.21.26.90:80

108.61.99.179:8080

165.227.156.155:443

159.69.89.130:8080

167.99.105.223:7080

5.196.74.210:8080

200.7.243.108:443

183.102.238.69:465

64.147.15.138:80

85.152.174.56:80

59.148.227.190:80

62.75.187.192:8080

174.77.190.137:8080

87.106.139.101:8080

173.247.19.238:80

2.38.99.79:80

178.210.51.222:8080

209.141.54.221:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	halscan.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	halscan.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	halscan.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	halscan.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	halscan.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	halscan.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	halscan.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	halscan.exe

Suspicious behavior: EmotetMutantsSpam 2 IoCs

pid	Process
2296	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe
3680	halscan.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3680	halscan.exe
3680	halscan.exe
3680	halscan.exe
3680	halscan.exe
3680	halscan.exe
3680	halscan.exe
3680	halscan.exe
3680	halscan.exe
3680	halscan.exe
3680	halscan.exe
3680	halscan.exe
3680	halscan.exe
3680	halscan.exe
3680	halscan.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2296	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3816	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe
3816	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe
2296	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe
2296	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe
3956	halscan.exe
3956	halscan.exe
3680	halscan.exe
3680	halscan.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 2296	3816	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe	72
PID 3816 wrote to memory of 2296	3816	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe	72
PID 3816 wrote to memory of 2296	3816	emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe	72
PID 3956 wrote to memory of 3680	3956	halscan.exe	77
PID 3956 wrote to memory of 3680	3956	halscan.exe	77
PID 3956 wrote to memory of 3680	3956	halscan.exe	77

C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe
"C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_72bc148b12ec1a9e9e8bb76db4a895074421d6f54e23a0bbb2c7f8a6ba950918_2020-10-11__163239._exe.exe
  --a1505d41
  2⤵
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  PID:2296

C:\Windows\SysWOW64\halscan.exe
"C:\Windows\SysWOW64\halscan.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Windows\SysWOW64\halscan.exe
  --b47ccd66
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2296-2-0x0000000002180000-0x0000000002197000-memory.dmp

Filesize
92KB

Download
memory/2296-3-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3680-7-0x0000000000570000-0x0000000000587000-memory.dmp

Filesize
92KB

Download
memory/3680-8-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3816-0-0x00000000022E0000-0x00000000022F7000-memory.dmp

Filesize
92KB

Download
memory/3956-4-0x0000000000E40000-0x0000000000E57000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing