emotet | 28758806c9b54d48e62445e5b8ad581ea0e6dc0233aaa0d701fd3ef9642bae1d

Reason

Machine shutdown

General

Target

657.bin.exe
Size

361KB
MD5

55cb6ea4c374a5c28ddb60754f7fa47d
SHA1

414ccc751051dde96679662b8067f8a13d722047
SHA256

004222c4f6b6df52371132843f2b7cff9d390b308438791df50fc9a9a38d47bd
SHA512

9b8a9eeafc0120628af504e086b5edf7eb627172a7d3c956da2913f2d69b8b99d041e7c4b2c5c852e57c37f62e9dabfc818d45ddc23935d3ba85e62076d6ff55

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

181.123.0.125:80

119.159.150.176:443

184.69.214.94:20

80.240.141.141:7080

185.187.198.10:8080

46.41.134.46:8080

178.249.187.151:8080

217.199.160.224:8080

186.83.133.253:8080

23.92.22.225:7080

212.71.237.140:8080

190.221.50.210:8080

187.199.158.226:443

185.86.148.222:8080

200.58.171.51:80

77.245.101.134:8080

201.163.74.202:443

203.25.159.3:8080

183.82.97.25:80

51.15.8.192:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

runningviolet.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	runningviolet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

runningviolet.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	runningviolet.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\32-e2-17-db-d2-77	runningviolet.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	runningviolet.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1"	runningviolet.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 0094fd9e4c10d701	runningviolet.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	runningviolet.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	runningviolet.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	runningviolet.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	runningviolet.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070054000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	runningviolet.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}	runningviolet.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionTime = 0094fd9e4c10d701	runningviolet.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecision = "0"	runningviolet.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	runningviolet.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadNetworkName = "Network"	runningviolet.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	runningviolet.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	runningviolet.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionReason = "1"	runningviolet.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77	runningviolet.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0"	runningviolet.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	runningviolet.exe

Suspicious behavior: EmotetMutantsSpam 2 IoCs

Processes:

657.bin.exerunningviolet.exe

pid process

1796 657.bin.exe
920 runningviolet.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

runningviolet.exe

pid process

920 runningviolet.exe
920 runningviolet.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

657.bin.exe

pid process

1796 657.bin.exe
Suspicious use of UnmapMainImage 4 IoCs

Processes:

657.bin.exe657.bin.exerunningviolet.exerunningviolet.exe

pid process

2008 657.bin.exe
1796 657.bin.exe
844 runningviolet.exe
920 runningviolet.exe

pid	process
1796	657.bin.exe
920	runningviolet.exe

pid	process
920	runningviolet.exe
920	runningviolet.exe

pid	process
1796	657.bin.exe

pid	process
2008	657.bin.exe
1796	657.bin.exe
844	runningviolet.exe
920	runningviolet.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

657.bin.exerunningviolet.exe

description	pid	process	target process
PID 2008 wrote to memory of 1796	2008	657.bin.exe	657.bin.exe
PID 2008 wrote to memory of 1796	2008	657.bin.exe	657.bin.exe
PID 2008 wrote to memory of 1796	2008	657.bin.exe	657.bin.exe
PID 2008 wrote to memory of 1796	2008	657.bin.exe	657.bin.exe
PID 844 wrote to memory of 920	844	runningviolet.exe	runningviolet.exe
PID 844 wrote to memory of 920	844	runningviolet.exe	runningviolet.exe
PID 844 wrote to memory of 920	844	runningviolet.exe	runningviolet.exe
PID 844 wrote to memory of 920	844	runningviolet.exe	runningviolet.exe

C:\Users\Admin\AppData\Local\Temp\657.bin.exe
"C:\Users\Admin\AppData\Local\Temp\657.bin.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2008

C:\Users\Admin\AppData\Local\Temp\657.bin.exe
--8db1875
2⤵
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:1796

C:\Windows\SysWOW64\runningviolet.exe
"C:\Windows\SysWOW64\runningviolet.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\SysWOW64\runningviolet.exe
--87766b54
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:920

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1188

C:\Users\Admin\AppData\Local\Temp\988111467\zmstage.exe
"C:\Users\Admin\AppData\Local\Temp\988111467\zmstage.exe"
1⤵
PID:1628

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:808

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1844

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-23-0x0000000002900000-0x0000000002901000-memory.dmp

Filesize
4KB

Download
memory/920-12-0x0000000000000000-mapping.dmp

Download
memory/920-15-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1188-18-0x000007FEFB891000-0x000007FEFB893000-memory.dmp

Filesize
8KB

Download
memory/1628-20-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1628-19-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1628-21-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1796-8-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1796-4-0x0000000000000000-mapping.dmp

Download
memory/1844-25-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download
memory/2008-6-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2008-2-0x0000000075EA1000-0x0000000075EA3000-memory.dmp

Filesize
8KB

Download
memory/2008-3-0x0000000002260000-0x0000000002275000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads