emotet | 69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae

General

Target
69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae.exe
Size 572KB
Sample201112-71cm3w4epx
SHA256 69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae
MD5 2dc61d2c800c14c92b3e28654e653f73
SHA1 040c21bbd678b35d12ebd0de2b1c9a6444c9c342
SHA512 c27cd7756d1c75f22da8a6568755aca9254bcb6408740f8205adf7627741b9a243ea7f76ef35cf887739291728178f4e4b3f280460e4c138fa2c0093edd0b023
MD5 SHA1 SHA512

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

95.179.195.74:80
47.146.42.234:80
188.14.39.65:443
104.236.137.72:8080
172.104.233.225:8080
213.189.36.51:8080
85.234.143.94:8080
138.68.106.4:7080
189.173.113.67:443
217.199.160.224:8080
190.97.30.167:990
46.101.212.195:8080
200.58.83.179:80
159.203.204.126:8080
2.38.99.79:80
110.143.18.92:80
82.196.15.205:8080
139.5.237.27:443
200.71.193.220:443
154.120.227.206:8080
142.93.114.137:8080
181.198.203.45:443
81.213.215.216:50000
91.205.215.57:7080
185.86.148.222:8080
190.146.131.105:8080
119.59.124.163:8080
37.132.193.19:8080
203.130.0.69:80
104.131.58.132:8080
69.163.33.84:8080
203.25.159.3:8080
77.55.211.77:8080
178.79.163.131:8080
190.17.42.79:80
96.20.84.254:7080
201.163.74.202:443
134.209.214.126:8080
77.241.53.234:80
181.135.153.203:443
186.15.83.52:8080
50.28.51.143:8080
190.186.164.23:80
212.71.237.140:8080
207.154.204.40:8080
86.42.166.147:80
149.62.173.247:8080
47.187.70.124:443
68.183.190.199:8080
190.38.14.52:80
190.195.129.227:8090
5.196.35.138:7080
200.113.106.18:80
200.124.225.32:80
118.200.218.193:443
68.183.170.114:8080
144.139.56.105:80
80.29.54.20:80
201.213.32.59:80
183.82.97.25:80
45.79.95.107:443
181.61.143.177:80
62.75.143.100:7080
190.102.226.91:80
163.172.40.218:7080
190.210.184.138:995
142.127.57.63:8080
98.196.49.107:80
109.166.89.91:80
181.231.62.54:80
125.99.61.162:7080
51.255.165.160:8080
182.48.194.6:8090
204.63.252.182:443
80.85.87.122:8080
109.169.86.13:8080
91.83.93.124:7080
186.68.48.204:443
116.48.138.115:80
46.28.111.142:7080
190.4.50.26:80
87.106.77.40:7080
88.250.223.190:8080
87.118.70.69:8080
200.123.101.90:80
201.190.133.235:8080
121.175.14.59:990
181.36.42.205:443
62.75.160.178:8080
91.204.163.19:8090
14.160.93.230:80
191.103.76.34:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	iasappid.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	iasappid.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	iasappid.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	iasappid.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	iasappid.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	iasappid.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	iasappid.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	iasappid.exe

Suspicious behavior: EmotetMutantsSpam 2 IoCs

pid	Process
416	69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae.exe
2312	iasappid.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2312	iasappid.exe
2312	iasappid.exe
2312	iasappid.exe
2312	iasappid.exe
2312	iasappid.exe
2312	iasappid.exe
2312	iasappid.exe
2312	iasappid.exe
2312	iasappid.exe
2312	iasappid.exe
2312	iasappid.exe
2312	iasappid.exe
2312	iasappid.exe
2312	iasappid.exe
2312	iasappid.exe
2312	iasappid.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
416	69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
584	69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae.exe
416	69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae.exe
2792	iasappid.exe
2312	iasappid.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 584 wrote to memory of 416	584	69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae.exe	77
PID 584 wrote to memory of 416	584	69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae.exe	77
PID 584 wrote to memory of 416	584	69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae.exe	77
PID 2792 wrote to memory of 2312	2792	iasappid.exe	80
PID 2792 wrote to memory of 2312	2792	iasappid.exe	80
PID 2792 wrote to memory of 2312	2792	iasappid.exe	80

C:\Users\Admin\AppData\Local\Temp\69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae.exe
"C:\Users\Admin\AppData\Local\Temp\69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:584
- C:\Users\Admin\AppData\Local\Temp\69cbbba35953f06e2e66c541e6727b66ec84cde5ad80e8ee10f83698573045ae.exe
  --808c3efc
  2⤵
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  PID:416

C:\Windows\SysWOW64\iasappid.exe
"C:\Windows\SysWOW64\iasappid.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\iasappid.exe
  --f7f13c33
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/416-2-0x0000000002150000-0x0000000002167000-memory.dmp

Download

memory/416-3-0x0000000000400000-0x0000000000493000-memory.dmp

Download

memory/584-0-0x00000000021D0000-0x00000000021E7000-memory.dmp

Download

memory/2312-7-0x0000000000F00000-0x0000000000F17000-memory.dmp

Download

memory/2312-8-0x0000000000400000-0x0000000000493000-memory.dmp

Download

memory/2792-4-0x0000000000620000-0x0000000000637000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads