emotet | b2e7ff81c8b393e97d4e970c883d9c2521036de2b1152e0f61098d2de82fd832

General

Target
b2e7ff81c8b393e97d4e970c883d9c2521036de2b1152e0f61098d2de82fd832.exe
Size 672KB
Sample201106-r2az2grmx6
SHA256 b2e7ff81c8b393e97d4e970c883d9c2521036de2b1152e0f61098d2de82fd832
MD5 cad5c15fd3db9f2f71a28f69f0c9b252
SHA1 986433e950daac923c9b464af05bdb2d0dc4f889
SHA512 019897a1d7a549361f6070859b4207db5f631a3bf909d16c6446b08bb4fe0accee214d55f371947759ef1b8b669118ee3fb0615aacd95c14aa6e18067f32b050
MD5 SHA1 SHA512

Score

10^/10

emotet banker trojan

Malware Config

Extracted

Family

emotet

C2

186.84.173.153:80
181.36.42.205:443
190.166.25.99:80
131.0.103.200:8080
78.46.103.90:7080
94.177.253.126:80
120.138.101.250:80
200.55.168.82:20
75.154.163.1:8090
95.216.207.86:7080
190.96.118.15:443
144.76.62.10:8080
212.112.113.235:80
184.82.233.15:80
157.7.164.178:8081
113.52.135.33:7080
176.58.93.123:80
51.38.134.203:8080
190.228.212.165:50000
203.99.188.11:443
181.61.143.177:80
216.70.88.55:8080
181.47.235.26:993
190.113.146.128:8080
216.75.37.196:8080
83.169.33.157:8080
201.196.15.79:990
91.109.5.28:8080
70.32.94.58:8080
186.109.91.136:80
186.146.110.108:8080
181.99.223.250:8080
192.241.220.183:8080
5.189.148.98:8080
190.117.206.153:443
186.92.11.143:8080
203.99.188.203:990
138.197.140.163:8080
190.13.146.47:443
185.45.24.254:7080
143.95.101.72:8080
203.99.182.135:443
201.217.113.58:8080
203.99.187.137:443
178.249.187.150:7080
154.120.227.206:8080
152.170.220.95:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	orgbrown.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	orgbrown.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	orgbrown.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	orgbrown.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	orgbrown.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	orgbrown.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	orgbrown.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	orgbrown.exe

Suspicious behavior: EmotetMutantsSpam 2 IoCs

pid	Process
2816	b2e7ff81c8b393e97d4e970c883d9c2521036de2b1152e0f61098d2de82fd832.exe
3684	orgbrown.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3684	orgbrown.exe
3684	orgbrown.exe
3684	orgbrown.exe
3684	orgbrown.exe
3684	orgbrown.exe
3684	orgbrown.exe
3684	orgbrown.exe
3684	orgbrown.exe
3684	orgbrown.exe
3684	orgbrown.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2816	b2e7ff81c8b393e97d4e970c883d9c2521036de2b1152e0f61098d2de82fd832.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
848	b2e7ff81c8b393e97d4e970c883d9c2521036de2b1152e0f61098d2de82fd832.exe
848	b2e7ff81c8b393e97d4e970c883d9c2521036de2b1152e0f61098d2de82fd832.exe
2816	b2e7ff81c8b393e97d4e970c883d9c2521036de2b1152e0f61098d2de82fd832.exe
2816	b2e7ff81c8b393e97d4e970c883d9c2521036de2b1152e0f61098d2de82fd832.exe
2544	orgbrown.exe
2544	orgbrown.exe
3684	orgbrown.exe
3684	orgbrown.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 2816	848	b2e7ff81c8b393e97d4e970c883d9c2521036de2b1152e0f61098d2de82fd832.exe	74
PID 848 wrote to memory of 2816	848	b2e7ff81c8b393e97d4e970c883d9c2521036de2b1152e0f61098d2de82fd832.exe	74
PID 848 wrote to memory of 2816	848	b2e7ff81c8b393e97d4e970c883d9c2521036de2b1152e0f61098d2de82fd832.exe	74
PID 2544 wrote to memory of 3684	2544	orgbrown.exe	80
PID 2544 wrote to memory of 3684	2544	orgbrown.exe	80
PID 2544 wrote to memory of 3684	2544	orgbrown.exe	80

C:\Users\Admin\AppData\Local\Temp\b2e7ff81c8b393e97d4e970c883d9c2521036de2b1152e0f61098d2de82fd832.exe
"C:\Users\Admin\AppData\Local\Temp\b2e7ff81c8b393e97d4e970c883d9c2521036de2b1152e0f61098d2de82fd832.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848
- C:\Users\Admin\AppData\Local\Temp\b2e7ff81c8b393e97d4e970c883d9c2521036de2b1152e0f61098d2de82fd832.exe
  --c8d0e7b5
  2⤵
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  PID:2816

C:\Windows\SysWOW64\orgbrown.exe
"C:\Windows\SysWOW64\orgbrown.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SysWOW64\orgbrown.exe
  --e76671c4
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/848-0-0x0000000002230000-0x0000000002247000-memory.dmp

Download

memory/2544-4-0x0000000000E50000-0x0000000000E67000-memory.dmp

Download

memory/2816-2-0x0000000002160000-0x0000000002177000-memory.dmp

Download

memory/2816-3-0x0000000000400000-0x00000000004AC000-memory.dmp

Download

memory/3684-6-0x0000000000680000-0x0000000000697000-memory.dmp

Download

memory/3684-7-0x0000000000400000-0x00000000004AC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads