emotet | d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b

General

Target

d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b.exe
Size

352KB
MD5

845c1812eb81a42882612e17e85a40be
SHA1

1bd4f31d6e895a0b006f5b850f079e731efa9ed3
SHA256

d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b
SHA512

c2933a33a9914aa809b414bd3a48fbe6b242ff58383d6ea43d094daab7666bf4a80604e999f75e0a682c330cf68379651e712585237d7318d1a640bafe775fff

Score

10^/10

emotet epoch3 banker discovery trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

152.32.75.74:443

91.121.200.35:8080

159.203.16.11:8080

188.226.165.170:8080

172.193.79.237:80

123.216.134.52:80

183.91.3.63:80

139.59.61.215:443

185.80.172.199:80

77.74.78.80:443

153.229.219.1:443

113.203.238.130:80

120.51.34.254:80

116.202.10.123:8080

5.2.246.108:80

50.116.78.109:8080

103.80.51.61:8080

190.55.186.229:80

185.142.236.163:443

223.17.215.76:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet Payload 4 IoCs

Detects Emotet payload in memory.

Processes:

resource	yara_rule
behavioral1/memory/1732-0-0x00000000023C0000-0x00000000023FD000-memory.dmp	emotet
behavioral1/memory/1732-1-0x0000000002400000-0x000000000243C000-memory.dmp	emotet
behavioral1/memory/1444-4-0x00000000003A0000-0x00000000003DD000-memory.dmp	emotet
behavioral1/memory/1444-5-0x0000000000460000-0x000000000049C000-memory.dmp	emotet

Executes dropped EXE 1 IoCs

Processes:

icacls.exe

pid process

1444 icacls.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1444 icacls.exe

pid	process
1444	icacls.exe

pid	process
1444	icacls.exe

Drops file in System32 directory 1 IoCs

Processes:

d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\printui\icacls.exe	d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

icacls.exe

pid process

1444 icacls.exe
1444 icacls.exe
1444 icacls.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b.exe

pid process

1732 d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b.exe

pid	process
1444	icacls.exe
1444	icacls.exe
1444	icacls.exe

pid	process
1732	d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b.exe

description	pid	process	target process
PID 1732 wrote to memory of 1444	1732	d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b.exe	icacls.exe
PID 1732 wrote to memory of 1444	1732	d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b.exe	icacls.exe
PID 1732 wrote to memory of 1444	1732	d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b.exe	icacls.exe
PID 1732 wrote to memory of 1444	1732	d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b.exe
"C:\Users\Admin\AppData\Local\Temp\d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\printui\icacls.exe
"C:\Windows\SysWOW64\printui\icacls.exe"
2⤵
- Executes dropped EXE
- Modifies file permissions
- Suspicious behavior: EnumeratesProcesses
PID:1444

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\printui\icacls.exe
MD5
845c1812eb81a42882612e17e85a40be

SHA1
1bd4f31d6e895a0b006f5b850f079e731efa9ed3

SHA256
d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b

SHA512
c2933a33a9914aa809b414bd3a48fbe6b242ff58383d6ea43d094daab7666bf4a80604e999f75e0a682c330cf68379651e712585237d7318d1a640bafe775fff

Download Submit
memory/1444-2-0x0000000000000000-mapping.dmp

Download
memory/1444-4-0x00000000003A0000-0x00000000003DD000-memory.dmp

Filesize
244KB

Download
memory/1444-5-0x0000000000460000-0x000000000049C000-memory.dmp

Filesize
240KB

Download
memory/1696-6-0x000007FEF6B80000-0x000007FEF6DFA000-memory.dmp

Filesize
2.5MB

Download
memory/1732-0-0x00000000023C0000-0x00000000023FD000-memory.dmp

Filesize
244KB

Download
memory/1732-1-0x0000000002400000-0x000000000243C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads