emotet | 69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae

General

Target
69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae.exe
Size 572KB
Sample201112-71cm3w4epx
SHA256 69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae
MD5 2dc61d2c800c14c92b3e28654e653f73
SHA1 040c21bbd678b35d12ebd0de2b1c9a6444c9c342
SHA512 c27cd7756d1c75f22da8a6568755aca9254bcb6408740f8205adf7627741b9a243ea7f76ef35cf887739291728178f4e4b3f280460e4c138fa2c0093edd0b023
MD5 SHA1 SHA512

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

95.179.195.74:80
47.146.42.234:80
188.14.39.65:443
104.236.137.72:8080
172.104.233.225:8080
213.189.36.51:8080
85.234.143.94:8080
138.68.106.4:7080
189.173.113.67:443
217.199.160.224:8080
190.97.30.167:990
46.101.212.195:8080
200.58.83.179:80
159.203.204.126:8080
2.38.99.79:80
110.143.18.92:80
82.196.15.205:8080
139.5.237.27:443
200.71.193.220:443
154.120.227.206:8080
142.93.114.137:8080
181.198.203.45:443
81.213.215.216:50000
91.205.215.57:7080
185.86.148.222:8080
190.146.131.105:8080
119.59.124.163:8080
37.132.193.19:8080
203.130.0.69:80
104.131.58.132:8080
69.163.33.84:8080
203.25.159.3:8080
77.55.211.77:8080
178.79.163.131:8080
190.17.42.79:80
96.20.84.254:7080
201.163.74.202:443
134.209.214.126:8080
77.241.53.234:80
181.135.153.203:443
186.15.83.52:8080
50.28.51.143:8080
190.186.164.23:80
212.71.237.140:8080
207.154.204.40:8080
86.42.166.147:80
149.62.173.247:8080
47.187.70.124:443
68.183.190.199:8080
190.38.14.52:80
190.195.129.227:8090
5.196.35.138:7080
200.113.106.18:80
200.124.225.32:80
118.200.218.193:443
68.183.170.114:8080
144.139.56.105:80
80.29.54.20:80
201.213.32.59:80
183.82.97.25:80
45.79.95.107:443
181.61.143.177:80
62.75.143.100:7080
190.102.226.91:80
163.172.40.218:7080
190.210.184.138:995
142.127.57.63:8080
98.196.49.107:80
109.166.89.91:80
181.231.62.54:80
125.99.61.162:7080
51.255.165.160:8080
182.48.194.6:8090
204.63.252.182:443
80.85.87.122:8080
109.169.86.13:8080
91.83.93.124:7080
186.68.48.204:443
116.48.138.115:80
46.28.111.142:7080
190.4.50.26:80
87.106.77.40:7080
88.250.223.190:8080
87.118.70.69:8080
200.123.101.90:80
201.190.133.235:8080
121.175.14.59:990
181.36.42.205:443
62.75.160.178:8080
91.204.163.19:8090
14.160.93.230:80
191.103.76.34:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	methodsipmi.exe

Modifies data under HKEY_USERS 25 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\32-e2-17-db-d2-77	methodsipmi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	methodsipmi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	methodsipmi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	methodsipmi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	methodsipmi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	methodsipmi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadNetworkName = "Network"	methodsipmi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	methodsipmi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionTime = 802a3d2c0bb9d601	methodsipmi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77	methodsipmi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1"	methodsipmi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0"	methodsipmi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	methodsipmi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}	methodsipmi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 802a3d2c0bb9d601	methodsipmi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = a06141670bb9d601	methodsipmi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionReason = "1"	methodsipmi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecision = "0"	methodsipmi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDetectedUrl	methodsipmi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	methodsipmi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	methodsipmi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	methodsipmi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	methodsipmi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	methodsipmi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionTime = a06141670bb9d601	methodsipmi.exe

Suspicious behavior: EmotetMutantsSpam 2 IoCs

pid	Process
1696	69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae.exe
1540	methodsipmi.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1540	methodsipmi.exe
1540	methodsipmi.exe
1540	methodsipmi.exe
1540	methodsipmi.exe
1540	methodsipmi.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1696	69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
752	69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae.exe
1696	69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae.exe
1588	methodsipmi.exe
1540	methodsipmi.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 1696	752	69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae.exe	29
PID 752 wrote to memory of 1696	752	69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae.exe	29
PID 752 wrote to memory of 1696	752	69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae.exe	29
PID 752 wrote to memory of 1696	752	69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae.exe	29
PID 1588 wrote to memory of 1540	1588	methodsipmi.exe	31
PID 1588 wrote to memory of 1540	1588	methodsipmi.exe	31
PID 1588 wrote to memory of 1540	1588	methodsipmi.exe	31
PID 1588 wrote to memory of 1540	1588	methodsipmi.exe	31

C:\Users\Admin\AppData\Local\Temp\69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae.exe
"C:\Users\Admin\AppData\Local\Temp\69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:752
- C:\Users\Admin\AppData\Local\Temp\69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae.exe
  --808c3efc
  2⤵
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  PID:1696

C:\Windows\SysWOW64\methodsipmi.exe
"C:\Windows\SysWOW64\methodsipmi.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\methodsipmi.exe
  --b8880e8b
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-0-0x00000000001D0000-0x00000000001E7000-memory.dmp

Download

memory/1540-6-0x0000000000C50000-0x0000000000C67000-memory.dmp

Download

memory/1540-7-0x0000000000400000-0x0000000000493000-memory.dmp

Download

memory/1540-8-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Download

memory/1540-9-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Download

memory/1588-4-0x0000000000520000-0x0000000000537000-memory.dmp

Download

memory/1696-2-0x00000000002E0000-0x00000000002F7000-memory.dmp

Download

memory/1696-3-0x0000000000400000-0x0000000000493000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads