emotet | 004222c4f6b6df52371132843f2b7cff9d390b308438791df50fc9a9a38d47bd

General

Target

657.exe
Size

361KB
MD5

55cb6ea4c374a5c28ddb60754f7fa47d
SHA1

414ccc751051dde96679662b8067f8a13d722047
SHA256

004222c4f6b6df52371132843f2b7cff9d390b308438791df50fc9a9a38d47bd
SHA512

9b8a9eeafc0120628af504e086b5edf7eb627172a7d3c956da2913f2d69b8b99d041e7c4b2c5c852e57c37f62e9dabfc818d45ddc23935d3ba85e62076d6ff55

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

181.123.0.125:80

119.159.150.176:443

184.69.214.94:20

80.240.141.141:7080

185.187.198.10:8080

46.41.134.46:8080

178.249.187.151:8080

217.199.160.224:8080

186.83.133.253:8080

23.92.22.225:7080

212.71.237.140:8080

190.221.50.210:8080

187.199.158.226:443

185.86.148.222:8080

200.58.171.51:80

77.245.101.134:8080

201.163.74.202:443

203.25.159.3:8080

183.82.97.25:80

51.15.8.192:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

toolsviolet.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	toolsviolet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 25 IoCs

Processes:

toolsviolet.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	toolsviolet.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6CD91550-F1B8-44A7-B169-07A502AE3F35}\WpadDecisionReason = "1"	toolsviolet.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6CD91550-F1B8-44A7-B169-07A502AE3F35}\WpadDecisionTime = b0a7edfa5510d701	toolsviolet.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6CD91550-F1B8-44A7-B169-07A502AE3F35}\WpadDecision = "0"	toolsviolet.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6CD91550-F1B8-44A7-B169-07A502AE3F35}\WpadDecisionTime = 107485365610d701	toolsviolet.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6CD91550-F1B8-44A7-B169-07A502AE3F35}	toolsviolet.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0"	toolsviolet.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	toolsviolet.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	toolsviolet.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	toolsviolet.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	toolsviolet.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	toolsviolet.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	toolsviolet.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070026000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	toolsviolet.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	toolsviolet.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	toolsviolet.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070026000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	toolsviolet.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6CD91550-F1B8-44A7-B169-07A502AE3F35}\32-e2-17-db-d2-77	toolsviolet.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1"	toolsviolet.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	toolsviolet.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6CD91550-F1B8-44A7-B169-07A502AE3F35}\WpadNetworkName = "Network"	toolsviolet.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77	toolsviolet.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = b0a7edfa5510d701	toolsviolet.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDetectedUrl	toolsviolet.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 107485365610d701	toolsviolet.exe

Suspicious behavior: EmotetMutantsSpam 2 IoCs

Processes:

657.exetoolsviolet.exe

pid process

1160 657.exe
1112 toolsviolet.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

toolsviolet.exe

pid process

1112 toolsviolet.exe
1112 toolsviolet.exe
1112 toolsviolet.exe
1112 toolsviolet.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

657.exe

pid process

1160 657.exe
Suspicious use of UnmapMainImage 4 IoCs

Processes:

657.exe657.exetoolsviolet.exetoolsviolet.exe

pid process

1096 657.exe
1160 657.exe
1752 toolsviolet.exe
1112 toolsviolet.exe

pid	process
1160	657.exe
1112	toolsviolet.exe

pid	process
1112	toolsviolet.exe
1112	toolsviolet.exe
1112	toolsviolet.exe
1112	toolsviolet.exe

pid	process
1160	657.exe

pid	process
1096	657.exe
1160	657.exe
1752	toolsviolet.exe
1112	toolsviolet.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

657.exetoolsviolet.exe

description	pid	process	target process
PID 1096 wrote to memory of 1160	1096	657.exe	657.exe
PID 1096 wrote to memory of 1160	1096	657.exe	657.exe
PID 1096 wrote to memory of 1160	1096	657.exe	657.exe
PID 1096 wrote to memory of 1160	1096	657.exe	657.exe
PID 1752 wrote to memory of 1112	1752	toolsviolet.exe	toolsviolet.exe
PID 1752 wrote to memory of 1112	1752	toolsviolet.exe	toolsviolet.exe
PID 1752 wrote to memory of 1112	1752	toolsviolet.exe	toolsviolet.exe
PID 1752 wrote to memory of 1112	1752	toolsviolet.exe	toolsviolet.exe

C:\Users\Admin\AppData\Local\Temp\657.exe
"C:\Users\Admin\AppData\Local\Temp\657.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1096

C:\Users\Admin\AppData\Local\Temp\657.exe
--4c577d7c
2⤵
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:1160

C:\Windows\SysWOW64\toolsviolet.exe
"C:\Windows\SysWOW64\toolsviolet.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\toolsviolet.exe
--23c3ce70
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1112

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-2-0x0000000075301000-0x0000000075303000-memory.dmp

Filesize
8KB

Download
memory/1096-3-0x00000000003E0000-0x00000000003F5000-memory.dmp

Filesize
84KB

Download
memory/1096-6-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1112-12-0x0000000000000000-mapping.dmp

Download
memory/1112-14-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1160-4-0x0000000000000000-mapping.dmp

Download
memory/1160-8-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads