emotet | 1276973fa6c5aa057ce9e7d60ae51e398cf41871b28d7fc9304c12d50a1fa938

General

Target
1276973fa6c5aa057ce9e7d60ae51e398cf41871b28d7fc9304c12d50a1fa938.exe
Size 672KB
Sample201113-qy2nj73lfx
SHA256 1276973fa6c5aa057ce9e7d60ae51e398cf41871b28d7fc9304c12d50a1fa938
MD5 1c52d1a85f6527e2503afb6682b6e56d
SHA1 87691d043e4afe111a2d29617cba91ece2437052
SHA512 eaff994902de4d8537ea16ca0c3da6090b73f78437058b2093ae0b17c9a1ec0eeae859d3d6ed9dd54cc7e50993494119a9f1709e93e747a9d293166b9820ab4d
MD5 SHA1 SHA512

Score

10^/10

emotet banker trojan

Malware Config

Extracted

Family

emotet

C2

186.84.173.153:80
181.36.42.205:443
190.166.25.99:80
131.0.103.200:8080
78.46.103.90:7080
94.177.253.126:80
120.138.101.250:80
200.55.168.82:20
75.154.163.1:8090
95.216.207.86:7080
190.96.118.15:443
144.76.62.10:8080
212.112.113.235:80
184.82.233.15:80
157.7.164.178:8081
113.52.135.33:7080
176.58.93.123:80
51.38.134.203:8080
190.228.212.165:50000
203.99.188.11:443
181.61.143.177:80
216.70.88.55:8080
181.47.235.26:993
190.113.146.128:8080
216.75.37.196:8080
83.169.33.157:8080
201.196.15.79:990
91.109.5.28:8080
70.32.94.58:8080
186.109.91.136:80
186.146.110.108:8080
181.99.223.250:8080
192.241.220.183:8080
5.189.148.98:8080
190.117.206.153:443
186.92.11.143:8080
203.99.188.203:990
138.197.140.163:8080
190.13.146.47:443
185.45.24.254:7080
143.95.101.72:8080
203.99.182.135:443
201.217.113.58:8080
203.99.187.137:443
178.249.187.150:7080
154.120.227.206:8080
152.170.220.95:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	moderntypeb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	moderntypeb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	moderntypeb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	moderntypeb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	moderntypeb.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	moderntypeb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	moderntypeb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	moderntypeb.exe

Suspicious behavior: EmotetMutantsSpam 2 IoCs

pid	Process
1608	1276973fa6c5aa057ce9e7d60ae51e398cf41871b28d7fc9304c12d50a1fa938.exe
3176	moderntypeb.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3176	moderntypeb.exe
3176	moderntypeb.exe
3176	moderntypeb.exe
3176	moderntypeb.exe
3176	moderntypeb.exe
3176	moderntypeb.exe
3176	moderntypeb.exe
3176	moderntypeb.exe
3176	moderntypeb.exe
3176	moderntypeb.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1608	1276973fa6c5aa057ce9e7d60ae51e398cf41871b28d7fc9304c12d50a1fa938.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
916	1276973fa6c5aa057ce9e7d60ae51e398cf41871b28d7fc9304c12d50a1fa938.exe
916	1276973fa6c5aa057ce9e7d60ae51e398cf41871b28d7fc9304c12d50a1fa938.exe
1608	1276973fa6c5aa057ce9e7d60ae51e398cf41871b28d7fc9304c12d50a1fa938.exe
1608	1276973fa6c5aa057ce9e7d60ae51e398cf41871b28d7fc9304c12d50a1fa938.exe
2236	moderntypeb.exe
2236	moderntypeb.exe
3176	moderntypeb.exe
3176	moderntypeb.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 1608	916	1276973fa6c5aa057ce9e7d60ae51e398cf41871b28d7fc9304c12d50a1fa938.exe	73
PID 916 wrote to memory of 1608	916	1276973fa6c5aa057ce9e7d60ae51e398cf41871b28d7fc9304c12d50a1fa938.exe	73
PID 916 wrote to memory of 1608	916	1276973fa6c5aa057ce9e7d60ae51e398cf41871b28d7fc9304c12d50a1fa938.exe	73
PID 2236 wrote to memory of 3176	2236	moderntypeb.exe	80
PID 2236 wrote to memory of 3176	2236	moderntypeb.exe	80
PID 2236 wrote to memory of 3176	2236	moderntypeb.exe	80

C:\Users\Admin\AppData\Local\Temp\1276973fa6c5aa057ce9e7d60ae51e398cf41871b28d7fc9304c12d50a1fa938.exe
"C:\Users\Admin\AppData\Local\Temp\1276973fa6c5aa057ce9e7d60ae51e398cf41871b28d7fc9304c12d50a1fa938.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:916
- C:\Users\Admin\AppData\Local\Temp\1276973fa6c5aa057ce9e7d60ae51e398cf41871b28d7fc9304c12d50a1fa938.exe
  --a17b53c
  2⤵
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  PID:1608

C:\Windows\SysWOW64\moderntypeb.exe
"C:\Windows\SysWOW64\moderntypeb.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\moderntypeb.exe
  --da3e1c9f
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/916-0-0x00000000006A0000-0x00000000006B7000-memory.dmp

Download

memory/1608-2-0x0000000002180000-0x0000000002197000-memory.dmp

Download

memory/1608-3-0x0000000000400000-0x00000000004AC000-memory.dmp

Download

memory/2236-4-0x00000000007C0000-0x00000000007D7000-memory.dmp

Download

memory/3176-6-0x0000000000630000-0x0000000000647000-memory.dmp

Download

memory/3176-7-0x0000000000400000-0x00000000004AC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads