emotet | 61a2f90d5f2c5c539d72b37f98163e58a34f1724d284ed0a1f3ceb46f1b3f642

General

Target

61a2f90d5f2c5c539d72b37f98163e58a34f1724d284ed0a1f3ceb46f1b3f642.exe
Size

368KB
MD5

6dd10b32ae1922ed8d8bc12dbe37bc99
SHA1

46c753db17c369d6cff7ac117593f5e0696e752b
SHA256

61a2f90d5f2c5c539d72b37f98163e58a34f1724d284ed0a1f3ceb46f1b3f642
SHA512

fc52c8b1d66de0dedf12c12d2100971181a5c46cf769ae819a9a8257c2543a2c9af533cc29908bb69a1a44f71de65a818b96db2b235c7697dddba40cc90e6eaa

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

177.103.159.44:80

113.190.254.245:80

103.31.232.93:443

91.236.4.234:443

110.145.124.178:443

120.150.76.215:80

45.161.242.102:80

82.240.207.95:443

177.66.190.130:80

203.25.159.3:8080

91.191.206.60:443

89.19.20.202:443

177.72.13.80:80

188.129.197.149:80

73.239.11.159:80

181.61.224.26:80

190.210.236.139:80

68.183.190.199:8080

47.150.248.161:80

152.231.89.226:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

sberes.exe

pid process

1268 sberes.exe
1268 sberes.exe
1268 sberes.exe
1268 sberes.exe
1268 sberes.exe
1268 sberes.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

61a2f90d5f2c5c539d72b37f98163e58a34f1724d284ed0a1f3ceb46f1b3f642.exe

pid process

484 61a2f90d5f2c5c539d72b37f98163e58a34f1724d284ed0a1f3ceb46f1b3f642.exe

pid	process
1268	sberes.exe
1268	sberes.exe
1268	sberes.exe
1268	sberes.exe
1268	sberes.exe
1268	sberes.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

61a2f90d5f2c5c539d72b37f98163e58a34f1724d284ed0a1f3ceb46f1b3f642.exesberes.exe

pid	process
484	61a2f90d5f2c5c539d72b37f98163e58a34f1724d284ed0a1f3ceb46f1b3f642.exe
484	61a2f90d5f2c5c539d72b37f98163e58a34f1724d284ed0a1f3ceb46f1b3f642.exe
1268	sberes.exe
1268	sberes.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

61a2f90d5f2c5c539d72b37f98163e58a34f1724d284ed0a1f3ceb46f1b3f642.exe

description	pid	process	target process
PID 484 wrote to memory of 1268	484	61a2f90d5f2c5c539d72b37f98163e58a34f1724d284ed0a1f3ceb46f1b3f642.exe	sberes.exe
PID 484 wrote to memory of 1268	484	61a2f90d5f2c5c539d72b37f98163e58a34f1724d284ed0a1f3ceb46f1b3f642.exe	sberes.exe
PID 484 wrote to memory of 1268	484	61a2f90d5f2c5c539d72b37f98163e58a34f1724d284ed0a1f3ceb46f1b3f642.exe	sberes.exe
PID 484 wrote to memory of 1268	484	61a2f90d5f2c5c539d72b37f98163e58a34f1724d284ed0a1f3ceb46f1b3f642.exe	sberes.exe

C:\Users\Admin\AppData\Local\Temp\61a2f90d5f2c5c539d72b37f98163e58a34f1724d284ed0a1f3ceb46f1b3f642.exe
"C:\Users\Admin\AppData\Local\Temp\61a2f90d5f2c5c539d72b37f98163e58a34f1724d284ed0a1f3ceb46f1b3f642.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:484

C:\Windows\SysWOW64\sberes\sberes.exe
"C:\Windows\SysWOW64\sberes\sberes.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1268

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/484-60-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download
memory/484-61-0x0000000000380000-0x000000000038C000-memory.dmp

Filesize
48KB

Download
memory/484-63-0x00000000002F0000-0x00000000002FE000-memory.dmp

Filesize
56KB

Download
memory/1268-64-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing