emotet | 9102ea05121b7b4e56d3d2ba64fca2451b60e7d4c10f07973c2e233cdd518927

General

Target
emotet_exe_e3_9102ea05121b7b4e56d3d2ba64fca2451b60e7d4c10f07973c2e233cdd518927_2020-10-31__000609._exe.exe
Size 356KB
Sample201031-8ctd1nta8s
SHA256 9102ea05121b7b4e56d3d2ba64fca2451b60e7d4c10f07973c2e233cdd518927
MD5 240438d7820e1311a84630f042f44ad8
SHA1 14cd167b37a527f2cab4d0e10d555eb9dc2495a6
SHA512 0d222ddb8f8c8a4fdab19830e4d39517f6ebd7a5ea5bd2e30485192acf70def8cd4d0cb60fac8df1ae71aa194fa1eca2396c86bd1803bb5c65d0a8ec337967e5
MD5 SHA1 SHA512

Score

10^/10

emotet epoch3 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

60.125.114.64:443
91.121.200.35:8080
159.203.16.11:8080
188.226.165.170:8080
36.91.44.183:80
5.12.246.155:80
172.193.79.237:80
190.180.65.104:80
46.32.229.152:8080
58.27.215.3:8080
75.127.14.170:8080
198.20.228.9:8080
37.205.9.252:7080
120.51.34.254:80
41.185.29.128:8080
172.105.78.244:8080
175.103.38.146:80
190.164.135.81:80
183.91.3.63:80
109.13.179.195:80
77.74.78.80:443
126.126.139.26:443
58.94.58.13:80
162.144.145.58:8080
197.221.227.78:80
180.148.4.130:8080
203.56.191.129:8080
103.229.73.17:8080
113.203.238.130:80
188.166.220.180:7080
152.32.75.74:443
178.254.36.182:8080
5.2.164.75:80
42.200.96.63:80
202.29.237.113:8080
190.192.39.136:80
103.93.220.182:80
109.99.146.210:8080
187.193.221.143:80
116.202.10.123:8080
46.105.131.68:8080
50.116.78.109:8080
181.59.59.54:80
185.208.226.142:8080
188.80.27.54:80
2.58.16.86:8080
192.241.220.183:8080
95.76.142.243:80
203.153.216.178:7080
157.7.164.178:8081
200.243.153.66:80
195.201.56.70:8080
73.55.128.120:80
190.85.46.52:7080
213.165.178.214:80
143.95.101.72:8080
41.76.213.144:8080
178.33.167.120:8080
201.163.74.203:80
185.142.236.163:443
121.117.147.153:443
190.212.140.6:80
60.108.128.186:80
177.130.51.198:80
54.38.143.245:8080
179.5.118.12:80
109.206.139.119:80
192.210.217.94:8080
85.246.78.192:80
45.239.204.100:80
185.80.172.199:80
91.75.75.46:80
2.82.75.215:80
115.79.195.246:80
190.55.186.229:80
8.4.9.137:8080
91.83.93.103:443
192.163.221.191:8080
117.2.139.117:443
78.90.78.210:80
153.229.219.1:443
110.37.224.243:80
115.79.59.157:80
37.46.129.215:8080
5.79.70.250:8080
153.204.122.254:80
74.208.173.91:8080
139.59.61.215:443
119.228.75.211:80
189.123.103.233:80
190.194.12.132:80
223.17.215.76:80
73.100.19.104:80
79.133.6.236:8080
103.80.51.61:8080
172.96.190.154:8080
5.2.246.108:80
139.59.12.63:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet Payload 4 IoCs

Detects Emotet payload in memory.

resource	yara_rule
behavioral2/memory/4640-0-0x0000000002EA0000-0x0000000002ED4000-memory.dmp	emotet
behavioral2/memory/4640-1-0x0000000002EE0000-0x0000000002F13000-memory.dmp	emotet
behavioral2/memory/3304-4-0x0000000000F30000-0x0000000000F64000-memory.dmp	emotet
behavioral2/memory/3304-5-0x0000000002930000-0x0000000002963000-memory.dmp	emotet

Executes dropped EXE 1 IoCs

pid	Process
3304	msjetoledb40.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dmintf\msjetoledb40.exe	emotet_exe_e3_9102ea05121b7b4e56d3d2ba64fca2451b60e7d4c10f07973c2e233cdd518927_2020-10-31__000609._exe.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3304	msjetoledb40.exe
3304	msjetoledb40.exe
3304	msjetoledb40.exe
3304	msjetoledb40.exe
3304	msjetoledb40.exe
3304	msjetoledb40.exe
3304	msjetoledb40.exe
3304	msjetoledb40.exe
3304	msjetoledb40.exe
3304	msjetoledb40.exe
3304	msjetoledb40.exe
3304	msjetoledb40.exe
3304	msjetoledb40.exe
3304	msjetoledb40.exe
3304	msjetoledb40.exe
3304	msjetoledb40.exe
3304	msjetoledb40.exe
3304	msjetoledb40.exe
3304	msjetoledb40.exe
3304	msjetoledb40.exe
3304	msjetoledb40.exe
3304	msjetoledb40.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4640	emotet_exe_e3_9102ea05121b7b4e56d3d2ba64fca2451b60e7d4c10f07973c2e233cdd518927_2020-10-31__000609._exe.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 3304	4640	emotet_exe_e3_9102ea05121b7b4e56d3d2ba64fca2451b60e7d4c10f07973c2e233cdd518927_2020-10-31__000609._exe.exe	78
PID 4640 wrote to memory of 3304	4640	emotet_exe_e3_9102ea05121b7b4e56d3d2ba64fca2451b60e7d4c10f07973c2e233cdd518927_2020-10-31__000609._exe.exe	78
PID 4640 wrote to memory of 3304	4640	emotet_exe_e3_9102ea05121b7b4e56d3d2ba64fca2451b60e7d4c10f07973c2e233cdd518927_2020-10-31__000609._exe.exe	78

C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_9102ea05121b7b4e56d3d2ba64fca2451b60e7d4c10f07973c2e233cdd518927_2020-10-31__000609._exe.exe
"C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_9102ea05121b7b4e56d3d2ba64fca2451b60e7d4c10f07973c2e233cdd518927_2020-10-31__000609._exe.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\SysWOW64\dmintf\msjetoledb40.exe
  "C:\Windows\SysWOW64\dmintf\msjetoledb40.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3304

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NgcSvc
1⤵
PID:5020

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
1⤵
PID:5060

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3304-4-0x0000000000F30000-0x0000000000F64000-memory.dmp

Download

memory/3304-5-0x0000000002930000-0x0000000002963000-memory.dmp

Download

memory/4640-0-0x0000000002EA0000-0x0000000002ED4000-memory.dmp

Download

memory/4640-1-0x0000000002EE0000-0x0000000002F13000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads