emotet | bf40ff2103fad9a3ecb8129387e450ad8b0b26822093399dbc44fa07fd77471a

General

Target
bf40ff2103fad9a3ecb8129387e450ad8b0b26822093399dbc44fa07fd77471a.exe
Size 668KB
Sample201108-px78c5feta
SHA256 bf40ff2103fad9a3ecb8129387e450ad8b0b26822093399dbc44fa07fd77471a
MD5 d0674ebdb5bbe3c12b9081566179d2c1
SHA1 eab5cad519cbfe5b0cefde4e37dd88b87ee27178
SHA512 340e80dceee2dd70751ba150424edcd095b567f5a1dcf640c1de5633fc8d9656478f12b709bd18a3c15bb8fabfe372f4a2fa7d80ad28ab0268b7950948582e89
MD5 SHA1 SHA512

Score

10^/10

emotet banker trojan

Malware Config

Extracted

Family

emotet

C2

181.16.17.210:443
79.127.57.43:80
81.169.140.14:443
94.177.183.28:8080
69.163.33.84:8080
200.57.102.71:8443
46.28.111.142:7080
76.69.29.42:80
119.159.150.176:443
217.199.160.224:8080
200.113.106.18:80
151.80.142.33:80
14.160.93.230:80
183.82.97.25:80
159.203.204.126:8080
186.90.29.228:443
46.101.212.195:8080
86.42.166.147:80
190.85.152.186:8080
87.106.77.40:7080
91.205.215.57:7080
119.59.124.163:8080
46.29.183.211:8080
94.183.71.206:7080
62.75.143.100:7080
185.187.198.10:8080
82.196.15.205:8080
51.15.8.192:8080
5.196.35.138:7080
190.104.253.234:990
109.169.86.13:8080
190.38.14.52:80
181.44.166.242:80
89.188.124.145:443
144.139.158.155:80
77.55.211.77:8080
68.183.170.114:8080
181.135.153.203:443
190.1.37.125:443
181.59.253.20:21
149.62.173.247:8080
181.51.251.236:443
203.25.159.3:8080
178.249.187.151:8080
185.86.148.222:8080
190.97.30.167:990
186.1.41.111:443
46.163.144.228:80
190.230.60.129:80
79.143.182.254:8080
138.68.106.4:7080
68.183.190.199:8080
190.10.194.42:8080
186.0.95.172:80
139.5.237.27:443
45.79.95.107:443
62.75.160.178:8080
104.131.58.132:8080
212.71.237.140:8080
91.204.163.19:8090
200.58.171.51:80
91.83.93.124:7080
46.41.151.103:8080
186.68.141.218:80
181.36.42.205:443
170.84.133.72:7080
80.85.87.122:8080
178.79.163.131:8080
79.129.0.173:8080
50.28.51.143:8080
201.163.74.202:443
77.245.101.134:8080
186.23.132.93:990
190.230.60.129:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	iellbuffer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	iellbuffer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	iellbuffer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	iellbuffer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	iellbuffer.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	iellbuffer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	iellbuffer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	iellbuffer.exe

Suspicious behavior: EmotetMutantsSpam 2 IoCs

pid	Process
2032	bf40ff2103fad9a3ecb8129387e450ad8b0b26822093399dbc44fa07fd77471a.exe
2236	iellbuffer.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2236	iellbuffer.exe
2236	iellbuffer.exe
2236	iellbuffer.exe
2236	iellbuffer.exe
2236	iellbuffer.exe
2236	iellbuffer.exe
2236	iellbuffer.exe
2236	iellbuffer.exe
2236	iellbuffer.exe
2236	iellbuffer.exe
2236	iellbuffer.exe
2236	iellbuffer.exe
2236	iellbuffer.exe
2236	iellbuffer.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2032	bf40ff2103fad9a3ecb8129387e450ad8b0b26822093399dbc44fa07fd77471a.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3152	bf40ff2103fad9a3ecb8129387e450ad8b0b26822093399dbc44fa07fd77471a.exe
3152	bf40ff2103fad9a3ecb8129387e450ad8b0b26822093399dbc44fa07fd77471a.exe
2032	bf40ff2103fad9a3ecb8129387e450ad8b0b26822093399dbc44fa07fd77471a.exe
2032	bf40ff2103fad9a3ecb8129387e450ad8b0b26822093399dbc44fa07fd77471a.exe
204	iellbuffer.exe
204	iellbuffer.exe
2236	iellbuffer.exe
2236	iellbuffer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 2032	3152	bf40ff2103fad9a3ecb8129387e450ad8b0b26822093399dbc44fa07fd77471a.exe	75
PID 3152 wrote to memory of 2032	3152	bf40ff2103fad9a3ecb8129387e450ad8b0b26822093399dbc44fa07fd77471a.exe	75
PID 3152 wrote to memory of 2032	3152	bf40ff2103fad9a3ecb8129387e450ad8b0b26822093399dbc44fa07fd77471a.exe	75
PID 204 wrote to memory of 2236	204	iellbuffer.exe	80
PID 204 wrote to memory of 2236	204	iellbuffer.exe	80
PID 204 wrote to memory of 2236	204	iellbuffer.exe	80

C:\Users\Admin\AppData\Local\Temp\bf40ff2103fad9a3ecb8129387e450ad8b0b26822093399dbc44fa07fd77471a.exe
"C:\Users\Admin\AppData\Local\Temp\bf40ff2103fad9a3ecb8129387e450ad8b0b26822093399dbc44fa07fd77471a.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Users\Admin\AppData\Local\Temp\bf40ff2103fad9a3ecb8129387e450ad8b0b26822093399dbc44fa07fd77471a.exe
  --5c96d3a
  2⤵
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  PID:2032

C:\Windows\SysWOW64\iellbuffer.exe
"C:\Windows\SysWOW64\iellbuffer.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:204
- C:\Windows\SysWOW64\iellbuffer.exe
  --e70cf4ae
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/204-4-0x0000000000720000-0x0000000000736000-memory.dmp

Download

memory/2032-2-0x0000000000630000-0x0000000000646000-memory.dmp

Download

memory/2032-3-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/2236-6-0x0000000000600000-0x0000000000616000-memory.dmp

Download

memory/2236-7-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/3152-0-0x0000000000670000-0x0000000000686000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads