emotet | 3942341d32ac846fddd15dad7e14e0f52437f136e97c7baafe247c79b7ebdd1a

Resubmissions

13-09-2021 08:58

210913-kw5cnagdgr 10

31-08-2021 06:48

210831-qqlfhj4bl6 10

Analysis

max time kernel
156s
max time network
166s
platform
windows10_x64
resource
win10v20210408
submitted
31-08-2021 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3942341d32ac846fddd15dad7e14e0f52437f136e97c7baafe247c79b7ebdd1a.exe
Size

1.0MB
MD5

752c55f5b44f362188a7bd114a22c04e
SHA1

7b75db98c3833ec7d8d75aa70243cabb1ac108c3
SHA256

3942341d32ac846fddd15dad7e14e0f52437f136e97c7baafe247c79b7ebdd1a
SHA512

f6f73a3eb687a63723b778f3ed73cfe8121e6cd4156c86690c23217bdd814d298d0f664d094187c953759d9712947a99b5f1404f21787056de2e96fc9df3505f

Score

10^/10

emotet epoch3 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

176.202.106.124:80

185.135.109.128:443

64.13.225.150:8080

149.210.171.237:8080

75.127.14.170:8080

200.82.88.254:80

181.39.96.86:443

182.71.222.187:80

139.59.12.63:8080

150.246.246.238:80

58.93.151.148:80

162.154.175.215:80

125.139.65.177:80

186.10.92.114:80

178.62.75.204:8080

184.162.115.11:443

212.129.14.27:8080

59.135.126.129:443

95.66.182.136:80

110.232.188.29:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

mfvdsp.exe

pid	process
204	mfvdsp.exe
204	mfvdsp.exe
204	mfvdsp.exe
204	mfvdsp.exe
204	mfvdsp.exe
204	mfvdsp.exe
204	mfvdsp.exe
204	mfvdsp.exe
204	mfvdsp.exe
204	mfvdsp.exe
204	mfvdsp.exe
204	mfvdsp.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

3942341d32ac846fddd15dad7e14e0f52437f136e97c7baafe247c79b7ebdd1a.exe

pid process

516 3942341d32ac846fddd15dad7e14e0f52437f136e97c7baafe247c79b7ebdd1a.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

3942341d32ac846fddd15dad7e14e0f52437f136e97c7baafe247c79b7ebdd1a.exemfvdsp.exe

pid process

516 3942341d32ac846fddd15dad7e14e0f52437f136e97c7baafe247c79b7ebdd1a.exe
204 mfvdsp.exe

pid	process
516	3942341d32ac846fddd15dad7e14e0f52437f136e97c7baafe247c79b7ebdd1a.exe

pid	process
516	3942341d32ac846fddd15dad7e14e0f52437f136e97c7baafe247c79b7ebdd1a.exe
204	mfvdsp.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

3942341d32ac846fddd15dad7e14e0f52437f136e97c7baafe247c79b7ebdd1a.exe

description	pid	process	target process
PID 516 wrote to memory of 204	516	3942341d32ac846fddd15dad7e14e0f52437f136e97c7baafe247c79b7ebdd1a.exe	mfvdsp.exe
PID 516 wrote to memory of 204	516	3942341d32ac846fddd15dad7e14e0f52437f136e97c7baafe247c79b7ebdd1a.exe	mfvdsp.exe
PID 516 wrote to memory of 204	516	3942341d32ac846fddd15dad7e14e0f52437f136e97c7baafe247c79b7ebdd1a.exe	mfvdsp.exe

C:\Users\Admin\AppData\Local\Temp\3942341d32ac846fddd15dad7e14e0f52437f136e97c7baafe247c79b7ebdd1a.exe
"C:\Users\Admin\AppData\Local\Temp\3942341d32ac846fddd15dad7e14e0f52437f136e97c7baafe247c79b7ebdd1a.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:516

C:\Windows\SysWOW64\mfvdsp\mfvdsp.exe
"C:\Windows\SysWOW64\mfvdsp\mfvdsp.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:204

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/204-117-0x0000000000000000-mapping.dmp

Download
memory/204-118-0x0000000000810000-0x000000000081C000-memory.dmp

Filesize
48KB

Download
memory/516-114-0x0000000002270000-0x000000000227C000-memory.dmp

Filesize
48KB

Download
memory/516-116-0x00000000006C0000-0x00000000006CA000-memory.dmp

Filesize
40KB

Download