emotet | 299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1

General

Target
299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe
Size 672KB
Sample201115-er84ebp2k2
SHA256 299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1
MD5 a80a0639d08e4fe74397468488bb7118
SHA1 ade08c94c922f288d615bd0f2724ab5fb17869b2
SHA512 5dc393a1a1109f752cbc57a92603cb4e2cb1ccb6f7f3b0ef46c6d0876d26db43431ea9647e657c9081756eae63af7e05a0bada8f32ed572782442572fce41699
MD5 SHA1 SHA512

Score

10^/10

emotet banker trojan

Malware Config

Extracted

Family

emotet

C2

186.84.173.153:80
181.36.42.205:443
190.166.25.99:80
131.0.103.200:8080
78.46.103.90:7080
94.177.253.126:80
120.138.101.250:80
200.55.168.82:20
75.154.163.1:8090
95.216.207.86:7080
190.96.118.15:443
144.76.62.10:8080
212.112.113.235:80
184.82.233.15:80
157.7.164.178:8081
113.52.135.33:7080
176.58.93.123:80
51.38.134.203:8080
190.228.212.165:50000
203.99.188.11:443
181.61.143.177:80
216.70.88.55:8080
181.47.235.26:993
190.113.146.128:8080
216.75.37.196:8080
83.169.33.157:8080
201.196.15.79:990
91.109.5.28:8080
70.32.94.58:8080
186.109.91.136:80
186.146.110.108:8080
181.99.223.250:8080
192.241.220.183:8080
5.189.148.98:8080
190.117.206.153:443
186.92.11.143:8080
203.99.188.203:990
138.197.140.163:8080
190.13.146.47:443
185.45.24.254:7080
143.95.101.72:8080
203.99.182.135:443
201.217.113.58:8080
203.99.187.137:443
178.249.187.150:7080
154.120.227.206:8080
152.170.220.95:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	mobsyncripple.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	mobsyncripple.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	mobsyncripple.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	mobsyncripple.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	mobsyncripple.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mobsyncripple.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mobsyncripple.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mobsyncripple.exe

Suspicious behavior: EmotetMutantsSpam 2 IoCs

pid	Process
3560	299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe
2192	mobsyncripple.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2192	mobsyncripple.exe
2192	mobsyncripple.exe
2192	mobsyncripple.exe
2192	mobsyncripple.exe
2192	mobsyncripple.exe
2192	mobsyncripple.exe
2192	mobsyncripple.exe
2192	mobsyncripple.exe
2192	mobsyncripple.exe
2192	mobsyncripple.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3560	299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
972	299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe
972	299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe
3560	299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe
3560	299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe
3772	mobsyncripple.exe
3772	mobsyncripple.exe
2192	mobsyncripple.exe
2192	mobsyncripple.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 3560	972	299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe	76
PID 972 wrote to memory of 3560	972	299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe	76
PID 972 wrote to memory of 3560	972	299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe	76
PID 3772 wrote to memory of 2192	3772	mobsyncripple.exe	81
PID 3772 wrote to memory of 2192	3772	mobsyncripple.exe	81
PID 3772 wrote to memory of 2192	3772	mobsyncripple.exe	81

C:\Users\Admin\AppData\Local\Temp\299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe
"C:\Users\Admin\AppData\Local\Temp\299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:972
- C:\Users\Admin\AppData\Local\Temp\299daa15a75c467e4d5af55b73f4f4d26dbf697ad0001b919dcc7809fe3aecd1.exe
  --fcaaffad
  2⤵
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  PID:3560

C:\Windows\SysWOW64\mobsyncripple.exe
"C:\Windows\SysWOW64\mobsyncripple.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Windows\SysWOW64\mobsyncripple.exe
  --2188f781
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/972-0-0x00000000022A0000-0x00000000022B7000-memory.dmp

Download

memory/2192-6-0x0000000000640000-0x0000000000657000-memory.dmp

Download

memory/2192-7-0x0000000000400000-0x00000000004AC000-memory.dmp

Download

memory/3560-3-0x0000000000400000-0x00000000004AC000-memory.dmp

Download

memory/3772-4-0x0000000000570000-0x0000000000587000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads