emotet | 986030c7d281e36317257f9fef2de47ba2cf9ac1c1fce13fd1c19f8198a8c3be

General

Target
986030c7d281e36317257f9fef2de47ba2cf9ac1c1fce13fd1c19f8198a8c3be.exe
Size 668KB
Sample201113-k4h4pq4ff6
SHA256 986030c7d281e36317257f9fef2de47ba2cf9ac1c1fce13fd1c19f8198a8c3be
MD5 209cac3fa3dc700ed82eb0abf31c3a3d
SHA1 612bbfbb7c2bd60142046abe6381ac3349e06c1a
SHA512 f9e5cfc8cbcaf1e2cba8be2769530f55fec0d65b5ff204866f398f749a28d099294fdc96e3875e3aa29ad92f4ba4b01d356cee7f7772d32e6e3db41599e1dbb8
MD5 SHA1 SHA512

Score

10^/10

emotet banker trojan

Malware Config

Extracted

Family

emotet

C2

181.16.17.210:443
79.127.57.43:80
81.169.140.14:443
94.177.183.28:8080
69.163.33.84:8080
200.57.102.71:8443
46.28.111.142:7080
76.69.29.42:80
119.159.150.176:443
217.199.160.224:8080
200.113.106.18:80
151.80.142.33:80
14.160.93.230:80
183.82.97.25:80
159.203.204.126:8080
186.90.29.228:443
46.101.212.195:8080
86.42.166.147:80
190.85.152.186:8080
87.106.77.40:7080
91.205.215.57:7080
119.59.124.163:8080
46.29.183.211:8080
94.183.71.206:7080
62.75.143.100:7080
185.187.198.10:8080
82.196.15.205:8080
51.15.8.192:8080
5.196.35.138:7080
190.104.253.234:990
109.169.86.13:8080
190.38.14.52:80
181.44.166.242:80
89.188.124.145:443
144.139.158.155:80
77.55.211.77:8080
68.183.170.114:8080
181.135.153.203:443
190.1.37.125:443
181.59.253.20:21
149.62.173.247:8080
181.51.251.236:443
203.25.159.3:8080
178.249.187.151:8080
185.86.148.222:8080
190.97.30.167:990
186.1.41.111:443
46.163.144.228:80
190.230.60.129:80
79.143.182.254:8080
138.68.106.4:7080
68.183.190.199:8080
190.10.194.42:8080
186.0.95.172:80
139.5.237.27:443
45.79.95.107:443
62.75.160.178:8080
104.131.58.132:8080
212.71.237.140:8080
91.204.163.19:8090
200.58.171.51:80
91.83.93.124:7080
46.41.151.103:8080
186.68.141.218:80
181.36.42.205:443
170.84.133.72:7080
80.85.87.122:8080
178.79.163.131:8080
79.129.0.173:8080
50.28.51.143:8080
201.163.74.202:443
77.245.101.134:8080
186.23.132.93:990
190.230.60.129:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	iellback.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	iellback.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	iellback.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	iellback.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	iellback.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	iellback.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	iellback.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	iellback.exe

Suspicious behavior: EmotetMutantsSpam 2 IoCs

pid	Process
620	986030c7d281e36317257f9fef2de47ba2cf9ac1c1fce13fd1c19f8198a8c3be.exe
2708	iellback.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2708	iellback.exe
2708	iellback.exe
2708	iellback.exe
2708	iellback.exe
2708	iellback.exe
2708	iellback.exe
2708	iellback.exe
2708	iellback.exe
2708	iellback.exe
2708	iellback.exe
2708	iellback.exe
2708	iellback.exe
2708	iellback.exe
2708	iellback.exe
2708	iellback.exe
2708	iellback.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
620	986030c7d281e36317257f9fef2de47ba2cf9ac1c1fce13fd1c19f8198a8c3be.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4076	986030c7d281e36317257f9fef2de47ba2cf9ac1c1fce13fd1c19f8198a8c3be.exe
4076	986030c7d281e36317257f9fef2de47ba2cf9ac1c1fce13fd1c19f8198a8c3be.exe
620	986030c7d281e36317257f9fef2de47ba2cf9ac1c1fce13fd1c19f8198a8c3be.exe
620	986030c7d281e36317257f9fef2de47ba2cf9ac1c1fce13fd1c19f8198a8c3be.exe
1464	iellback.exe
1464	iellback.exe
2708	iellback.exe
2708	iellback.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 620	4076	986030c7d281e36317257f9fef2de47ba2cf9ac1c1fce13fd1c19f8198a8c3be.exe	72
PID 4076 wrote to memory of 620	4076	986030c7d281e36317257f9fef2de47ba2cf9ac1c1fce13fd1c19f8198a8c3be.exe	72
PID 4076 wrote to memory of 620	4076	986030c7d281e36317257f9fef2de47ba2cf9ac1c1fce13fd1c19f8198a8c3be.exe	72
PID 1464 wrote to memory of 2708	1464	iellback.exe	80
PID 1464 wrote to memory of 2708	1464	iellback.exe	80
PID 1464 wrote to memory of 2708	1464	iellback.exe	80

C:\Users\Admin\AppData\Local\Temp\986030c7d281e36317257f9fef2de47ba2cf9ac1c1fce13fd1c19f8198a8c3be.exe
"C:\Users\Admin\AppData\Local\Temp\986030c7d281e36317257f9fef2de47ba2cf9ac1c1fce13fd1c19f8198a8c3be.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Users\Admin\AppData\Local\Temp\986030c7d281e36317257f9fef2de47ba2cf9ac1c1fce13fd1c19f8198a8c3be.exe
  --35f30e30
  2⤵
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  PID:620

C:\Windows\SysWOW64\iellback.exe
"C:\Windows\SysWOW64\iellback.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\iellback.exe
  --aa00ec15
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/620-2-0x00000000005A0000-0x00000000005B6000-memory.dmp

Download

memory/620-3-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/1464-4-0x0000000000E00000-0x0000000000E16000-memory.dmp

Download

memory/2708-6-0x0000000000640000-0x0000000000656000-memory.dmp

Download

memory/2708-7-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/4076-0-0x0000000000700000-0x0000000000716000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads