emotet | a35345badf0d592e292e05b3107d4c602d05e212eca9a897b1282554e64c838b

General

Target

a35345badf0d592e292e05b3107d4c602d05e212eca9a897b1282554e64c838b.exe
Size

368KB
MD5

b409c006b36650dbbc8c95f64cd62922
SHA1

c05d0f80916d8fa2061dfa37e56d398b4ba27b79
SHA256

a35345badf0d592e292e05b3107d4c602d05e212eca9a897b1282554e64c838b
SHA512

145bf0358628e010ead70a8df58a1e118ad4e87d76b32ffd13df6a9fecfd83799e3631ceb93e19b36cc35c219f6527cd55b48e49ba898455819be1e5f45ea639

Score

10^/10

emotet epoch3 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

118.167.155.233:80

110.37.226.196:443

178.33.167.120:8080

124.150.175.133:443

87.252.100.28:80

75.127.14.170:8080

190.247.9.40:443

181.225.24.251:80

45.55.179.121:8080

154.120.227.190:443

91.83.93.103:443

188.251.213.180:443

211.20.154.102:443

186.80.169.128:80

192.210.217.94:8080

58.93.151.148:80

178.62.75.204:8080

70.45.30.28:80

14.161.30.33:443

45.118.136.92:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

wmpeffects.exe

pid process

1500 wmpeffects.exe
1500 wmpeffects.exe
1500 wmpeffects.exe
1500 wmpeffects.exe
1500 wmpeffects.exe
1500 wmpeffects.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

a35345badf0d592e292e05b3107d4c602d05e212eca9a897b1282554e64c838b.exe

pid process

1084 a35345badf0d592e292e05b3107d4c602d05e212eca9a897b1282554e64c838b.exe

pid	process
1500	wmpeffects.exe
1500	wmpeffects.exe
1500	wmpeffects.exe
1500	wmpeffects.exe
1500	wmpeffects.exe
1500	wmpeffects.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

a35345badf0d592e292e05b3107d4c602d05e212eca9a897b1282554e64c838b.exewmpeffects.exe

pid	process
1084	a35345badf0d592e292e05b3107d4c602d05e212eca9a897b1282554e64c838b.exe
1084	a35345badf0d592e292e05b3107d4c602d05e212eca9a897b1282554e64c838b.exe
1500	wmpeffects.exe
1500	wmpeffects.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a35345badf0d592e292e05b3107d4c602d05e212eca9a897b1282554e64c838b.exe

description	pid	process	target process
PID 1084 wrote to memory of 1500	1084	a35345badf0d592e292e05b3107d4c602d05e212eca9a897b1282554e64c838b.exe	wmpeffects.exe
PID 1084 wrote to memory of 1500	1084	a35345badf0d592e292e05b3107d4c602d05e212eca9a897b1282554e64c838b.exe	wmpeffects.exe
PID 1084 wrote to memory of 1500	1084	a35345badf0d592e292e05b3107d4c602d05e212eca9a897b1282554e64c838b.exe	wmpeffects.exe
PID 1084 wrote to memory of 1500	1084	a35345badf0d592e292e05b3107d4c602d05e212eca9a897b1282554e64c838b.exe	wmpeffects.exe

C:\Users\Admin\AppData\Local\Temp\a35345badf0d592e292e05b3107d4c602d05e212eca9a897b1282554e64c838b.exe
"C:\Users\Admin\AppData\Local\Temp\a35345badf0d592e292e05b3107d4c602d05e212eca9a897b1282554e64c838b.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084

C:\Windows\SysWOW64\wmpeffects\wmpeffects.exe
"C:\Windows\SysWOW64\wmpeffects\wmpeffects.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1500

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1084-60-0x0000000075411000-0x0000000075413000-memory.dmp

Filesize
8KB

Download
memory/1084-61-0x00000000002D0000-0x00000000002DC000-memory.dmp

Filesize
48KB

Download
memory/1084-63-0x0000000000270000-0x000000000027E000-memory.dmp

Filesize
56KB

Download
memory/1500-64-0x0000000000000000-mapping.dmp

Download
memory/1500-66-0x0000000000300000-0x000000000030C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing