emotet | ea1025ebfb2cbc8b7ee79006a44c6c036329701015d45f6f3777e58915b83726

General

Target

ea1025ebfb2cbc8b7ee79006a44c6c036329701015d45f6f3777e58915b83726_yzXwDsU.exe
Size

419KB
MD5

9cf2c56ef2d9ed4c679013369c6bf4c0
SHA1

77a2d90daf8ccff12ba036924d49c0d57cfbc89b
SHA256

ea1025ebfb2cbc8b7ee79006a44c6c036329701015d45f6f3777e58915b83726
SHA512

824fa156c422176b7f41aeae17fe10ea40bd0cb4337a3093b76b7416add2412d6de606d12b0f50a9de0b68e92456728b4b6e1829f2c2324a667282c73a0e6598

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

47.148.241.179:80

24.204.47.87:80

80.86.91.91:8080

104.236.28.47:8080

87.106.136.232:8080

211.63.71.72:8080

113.52.123.226:7080

78.101.70.199:443

76.86.17.1:80

222.144.13.169:80

47.155.214.239:80

181.143.126.170:80

169.239.182.217:8080

181.126.70.117:80

209.137.209.84:443

207.177.72.129:8080

37.139.21.175:8080

149.202.153.252:8080

108.6.170.195:80

37.187.72.193:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

mscat32.exe

pid process

532 mscat32.exe
532 mscat32.exe
532 mscat32.exe
532 mscat32.exe
532 mscat32.exe
532 mscat32.exe
532 mscat32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

ea1025ebfb2cbc8b7ee79006a44c6c036329701015d45f6f3777e58915b83726_yzXwDsU.exe

pid process

1608 ea1025ebfb2cbc8b7ee79006a44c6c036329701015d45f6f3777e58915b83726_yzXwDsU.exe

pid	process
532	mscat32.exe
532	mscat32.exe
532	mscat32.exe
532	mscat32.exe
532	mscat32.exe
532	mscat32.exe
532	mscat32.exe

pid	process
1608	ea1025ebfb2cbc8b7ee79006a44c6c036329701015d45f6f3777e58915b83726_yzXwDsU.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1988	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1988	AUDIODG.EXE
Token: 33	1988	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1988	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ea1025ebfb2cbc8b7ee79006a44c6c036329701015d45f6f3777e58915b83726_yzXwDsU.exemscat32.exe

pid process

1608 ea1025ebfb2cbc8b7ee79006a44c6c036329701015d45f6f3777e58915b83726_yzXwDsU.exe
532 mscat32.exe

pid	process
1608	ea1025ebfb2cbc8b7ee79006a44c6c036329701015d45f6f3777e58915b83726_yzXwDsU.exe
532	mscat32.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ea1025ebfb2cbc8b7ee79006a44c6c036329701015d45f6f3777e58915b83726_yzXwDsU.exe

description	pid	process	target process
PID 1608 wrote to memory of 532	1608	ea1025ebfb2cbc8b7ee79006a44c6c036329701015d45f6f3777e58915b83726_yzXwDsU.exe	mscat32.exe
PID 1608 wrote to memory of 532	1608	ea1025ebfb2cbc8b7ee79006a44c6c036329701015d45f6f3777e58915b83726_yzXwDsU.exe	mscat32.exe
PID 1608 wrote to memory of 532	1608	ea1025ebfb2cbc8b7ee79006a44c6c036329701015d45f6f3777e58915b83726_yzXwDsU.exe	mscat32.exe
PID 1608 wrote to memory of 532	1608	ea1025ebfb2cbc8b7ee79006a44c6c036329701015d45f6f3777e58915b83726_yzXwDsU.exe	mscat32.exe

C:\Users\Admin\AppData\Local\Temp\ea1025ebfb2cbc8b7ee79006a44c6c036329701015d45f6f3777e58915b83726_yzXwDsU.exe
"C:\Users\Admin\AppData\Local\Temp\ea1025ebfb2cbc8b7ee79006a44c6c036329701015d45f6f3777e58915b83726_yzXwDsU.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\SysWOW64\mscat32\mscat32.exe
"C:\Windows\SysWOW64\mscat32\mscat32.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:532

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:784

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0xc8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1988

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/532-64-0x0000000000000000-mapping.dmp

Download
memory/532-66-0x0000000000360000-0x000000000036C000-memory.dmp

Filesize
48KB

Download
memory/784-69-0x000007FEFB631000-0x000007FEFB633000-memory.dmp

Filesize
8KB

Download
memory/1608-60-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/1608-61-0x0000000000260000-0x000000000026C000-memory.dmp

Filesize
48KB

Download
memory/1608-63-0x00000000001D0000-0x00000000001DA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing