emotet | dfbbedf7be5d0f4e2704d2868f3f9682e3df6eed9699d63eee39c4749bddc08d

General

Target

dfbbedf7be5d0f4e2704d2868f3f9682e3df6eed9699d63eee39c4749bddc08d.exe
Size

368KB
MD5

a9e9348449f05c1e9fb9d930ff2ab455
SHA1

a2d4ab78e360551db2e62026e3935e7f6848e42b
SHA256

dfbbedf7be5d0f4e2704d2868f3f9682e3df6eed9699d63eee39c4749bddc08d
SHA512

1b9c11f341f0e4a2774a597121f164241d63d36d0662741de98d53652e8949cd6bfb8ae7238eb9e5837d43a15c3f3123d058d3ebbc87774998b197bf469d5fea

Score

10^/10

emotet epoch3 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

118.167.155.233:80

110.37.226.196:443

178.33.167.120:8080

124.150.175.133:443

87.252.100.28:80

75.127.14.170:8080

190.247.9.40:443

181.225.24.251:80

45.55.179.121:8080

154.120.227.190:443

91.83.93.103:443

188.251.213.180:443

211.20.154.102:443

186.80.169.128:80

192.210.217.94:8080

58.93.151.148:80

178.62.75.204:8080

70.45.30.28:80

14.161.30.33:443

45.118.136.92:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

OpcServices.exe

pid	process
2664	OpcServices.exe
2664	OpcServices.exe
2664	OpcServices.exe
2664	OpcServices.exe
2664	OpcServices.exe
2664	OpcServices.exe
2664	OpcServices.exe
2664	OpcServices.exe
2664	OpcServices.exe
2664	OpcServices.exe
2664	OpcServices.exe
2664	OpcServices.exe
2664	OpcServices.exe
2664	OpcServices.exe
2664	OpcServices.exe
2664	OpcServices.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

dfbbedf7be5d0f4e2704d2868f3f9682e3df6eed9699d63eee39c4749bddc08d.exe

pid process

4020 dfbbedf7be5d0f4e2704d2868f3f9682e3df6eed9699d63eee39c4749bddc08d.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

dfbbedf7be5d0f4e2704d2868f3f9682e3df6eed9699d63eee39c4749bddc08d.exeOpcServices.exe

pid	process
4020	dfbbedf7be5d0f4e2704d2868f3f9682e3df6eed9699d63eee39c4749bddc08d.exe
4020	dfbbedf7be5d0f4e2704d2868f3f9682e3df6eed9699d63eee39c4749bddc08d.exe
2664	OpcServices.exe
2664	OpcServices.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

dfbbedf7be5d0f4e2704d2868f3f9682e3df6eed9699d63eee39c4749bddc08d.exe

description	pid	process	target process
PID 4020 wrote to memory of 2664	4020	dfbbedf7be5d0f4e2704d2868f3f9682e3df6eed9699d63eee39c4749bddc08d.exe	OpcServices.exe
PID 4020 wrote to memory of 2664	4020	dfbbedf7be5d0f4e2704d2868f3f9682e3df6eed9699d63eee39c4749bddc08d.exe	OpcServices.exe
PID 4020 wrote to memory of 2664	4020	dfbbedf7be5d0f4e2704d2868f3f9682e3df6eed9699d63eee39c4749bddc08d.exe	OpcServices.exe

C:\Users\Admin\AppData\Local\Temp\dfbbedf7be5d0f4e2704d2868f3f9682e3df6eed9699d63eee39c4749bddc08d.exe
"C:\Users\Admin\AppData\Local\Temp\dfbbedf7be5d0f4e2704d2868f3f9682e3df6eed9699d63eee39c4749bddc08d.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4020

C:\Windows\SysWOW64\OpcServices\OpcServices.exe
"C:\Windows\SysWOW64\OpcServices\OpcServices.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2664

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2664-117-0x0000000000000000-mapping.dmp

Download
memory/2664-118-0x0000000000900000-0x000000000090C000-memory.dmp

Filesize
48KB

Download
memory/4020-114-0x0000000000A40000-0x0000000000A4C000-memory.dmp

Filesize
48KB

Download
memory/4020-116-0x0000000000A30000-0x0000000000A3E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads