emotet | 299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1

General

Target
299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe
Size 672KB
Sample201115-er84ebp2k2
SHA256 299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1
MD5 a80a0639d08e4fe74397468488bb7118
SHA1 ade08c94c922f288d615bd0f2724ab5fb17869b2
SHA512 5dc393a1a1109f752cbc57a92603cb4e2cb1ccb6f7f3b0ef46c6d0876d26db43431ea9647e657c9081756eae63af7e05a0bada8f32ed572782442572fce41699
MD5 SHA1 SHA512

Score

10^/10

emotet banker trojan

Malware Config

Extracted

Family

emotet

C2

186.84.173.153:80
181.36.42.205:443
190.166.25.99:80
131.0.103.200:8080
78.46.103.90:7080
94.177.253.126:80
120.138.101.250:80
200.55.168.82:20
75.154.163.1:8090
95.216.207.86:7080
190.96.118.15:443
144.76.62.10:8080
212.112.113.235:80
184.82.233.15:80
157.7.164.178:8081
113.52.135.33:7080
176.58.93.123:80
51.38.134.203:8080
190.228.212.165:50000
203.99.188.11:443
181.61.143.177:80
216.70.88.55:8080
181.47.235.26:993
190.113.146.128:8080
216.75.37.196:8080
83.169.33.157:8080
201.196.15.79:990
91.109.5.28:8080
70.32.94.58:8080
186.109.91.136:80
186.146.110.108:8080
181.99.223.250:8080
192.241.220.183:8080
5.189.148.98:8080
190.117.206.153:443
186.92.11.143:8080
203.99.188.203:990
138.197.140.163:8080
190.13.146.47:443
185.45.24.254:7080
143.95.101.72:8080
203.99.182.135:443
201.217.113.58:8080
203.99.187.137:443
178.249.187.150:7080
154.120.227.206:8080
152.170.220.95:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	modernrus.exe

Modifies data under HKEY_USERS 21 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0"	modernrus.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	modernrus.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	modernrus.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	modernrus.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecision = "0"	modernrus.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070041000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	modernrus.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionTime = e02534ffa7bbd601	modernrus.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\32-e2-17-db-d2-77	modernrus.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1"	modernrus.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	modernrus.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	modernrus.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	modernrus.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	modernrus.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionReason = "1"	modernrus.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadNetworkName = "Network"	modernrus.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = e02534ffa7bbd601	modernrus.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77	modernrus.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	modernrus.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	modernrus.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	modernrus.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}	modernrus.exe

Suspicious behavior: EmotetMutantsSpam 2 IoCs

pid	Process
1440	299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe
1092	modernrus.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1092	modernrus.exe
1092	modernrus.exe
1092	modernrus.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1440	299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1912	299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe
1912	299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe
1440	299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe
1440	299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe
776	modernrus.exe
776	modernrus.exe
1092	modernrus.exe
1092	modernrus.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1440	1912	299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe	26
PID 1912 wrote to memory of 1440	1912	299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe	26
PID 1912 wrote to memory of 1440	1912	299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe	26
PID 1912 wrote to memory of 1440	1912	299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe	26
PID 776 wrote to memory of 1092	776	modernrus.exe	31
PID 776 wrote to memory of 1092	776	modernrus.exe	31
PID 776 wrote to memory of 1092	776	modernrus.exe	31
PID 776 wrote to memory of 1092	776	modernrus.exe	31

C:\Users\Admin\AppData\Local\Temp\299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe
"C:\Users\Admin\AppData\Local\Temp\299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Users\Admin\AppData\Local\Temp\299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe
  --fcaaffad
  2⤵
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  PID:1440

C:\Windows\SysWOW64\modernrus.exe
"C:\Windows\SysWOW64\modernrus.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:776
- C:\Windows\SysWOW64\modernrus.exe
  --9395da67
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/776-4-0x00000000003E0000-0x00000000003F7000-memory.dmp

Download

memory/1092-6-0x00000000002C0000-0x00000000002D7000-memory.dmp

Download

memory/1092-7-0x0000000000400000-0x00000000004AC000-memory.dmp

Download

memory/1440-2-0x0000000000280000-0x0000000000297000-memory.dmp

Download

memory/1440-3-0x0000000000400000-0x00000000004AC000-memory.dmp

Download

memory/1912-0-0x0000000000300000-0x0000000000317000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads