emotet | 2cb7516c937ad8b9467ca417530651e34340d231c3696149c7d7b22e24ffaf9b

General

Target

2cb7516c937ad8b9467ca417530651e34340d231c3696149c7d7b22e24ffaf9b.exe
Size

356KB
MD5

3639d17c4944743ac5c70c4e1bd30178
SHA1

0047a882cf542b94754496c8cb985ab64561f72c
SHA256

2cb7516c937ad8b9467ca417530651e34340d231c3696149c7d7b22e24ffaf9b
SHA512

efbc3c75d893baa3e5fc5329ef7bc3163e686850f9196e2ba758b486b18743fd2487476976d6c55b826da2ab1a017ae854af0c53d4b95865a5221a387ba9ad11

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

102.182.145.130:80

173.173.254.105:80

64.207.182.168:8080

51.89.199.141:8080

167.114.153.111:8080

173.63.222.65:80

218.147.193.146:80

59.125.219.109:443

172.104.97.173:8080

190.162.215.233:80

68.115.186.26:80

78.188.106.53:443

190.240.194.77:443

24.133.106.23:80

80.227.52.78:80

79.137.83.50:443

120.150.218.241:443

62.171.142.179:8080

194.4.58.192:7080

62.30.7.67:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet Payload 4 IoCs

Detects Emotet payload in memory.

Processes:

resource	yara_rule
behavioral1/memory/1188-53-0x00000000003C0000-0x00000000003F4000-memory.dmp	emotet
behavioral1/memory/1188-56-0x0000000000D70000-0x0000000000DA3000-memory.dmp	emotet
behavioral1/memory/1188-59-0x0000000000380000-0x00000000003B1000-memory.dmp	emotet
behavioral1/memory/2000-63-0x00000000003A0000-0x00000000003D4000-memory.dmp	emotet

Executes dropped EXE 1 IoCs

Processes:

glmf32.exe

pid process

2000 glmf32.exe

pid	process
2000	glmf32.exe

Drops file in System32 directory 1 IoCs

Processes:

2cb7516c937ad8b9467ca417530651e34340d231c3696149c7d7b22e24ffaf9b.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\ieapfltr\glmf32.exe	2cb7516c937ad8b9467ca417530651e34340d231c3696149c7d7b22e24ffaf9b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

glmf32.exe

pid process

2000 glmf32.exe
2000 glmf32.exe
2000 glmf32.exe
2000 glmf32.exe
2000 glmf32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

2cb7516c937ad8b9467ca417530651e34340d231c3696149c7d7b22e24ffaf9b.exe

pid process

1188 2cb7516c937ad8b9467ca417530651e34340d231c3696149c7d7b22e24ffaf9b.exe

pid	process
2000	glmf32.exe
2000	glmf32.exe
2000	glmf32.exe
2000	glmf32.exe
2000	glmf32.exe

pid	process
1188	2cb7516c937ad8b9467ca417530651e34340d231c3696149c7d7b22e24ffaf9b.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2cb7516c937ad8b9467ca417530651e34340d231c3696149c7d7b22e24ffaf9b.exe

description	pid	process	target process
PID 1188 wrote to memory of 2000	1188	2cb7516c937ad8b9467ca417530651e34340d231c3696149c7d7b22e24ffaf9b.exe	glmf32.exe
PID 1188 wrote to memory of 2000	1188	2cb7516c937ad8b9467ca417530651e34340d231c3696149c7d7b22e24ffaf9b.exe	glmf32.exe
PID 1188 wrote to memory of 2000	1188	2cb7516c937ad8b9467ca417530651e34340d231c3696149c7d7b22e24ffaf9b.exe	glmf32.exe
PID 1188 wrote to memory of 2000	1188	2cb7516c937ad8b9467ca417530651e34340d231c3696149c7d7b22e24ffaf9b.exe	glmf32.exe

C:\Users\Admin\AppData\Local\Temp\2cb7516c937ad8b9467ca417530651e34340d231c3696149c7d7b22e24ffaf9b.exe
"C:\Users\Admin\AppData\Local\Temp\2cb7516c937ad8b9467ca417530651e34340d231c3696149c7d7b22e24ffaf9b.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1188

C:\Windows\SysWOW64\ieapfltr\glmf32.exe
"C:\Windows\SysWOW64\ieapfltr\glmf32.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2000

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ieapfltr\glmf32.exe
MD5
3639d17c4944743ac5c70c4e1bd30178

SHA1
0047a882cf542b94754496c8cb985ab64561f72c

SHA256
2cb7516c937ad8b9467ca417530651e34340d231c3696149c7d7b22e24ffaf9b

SHA512
efbc3c75d893baa3e5fc5329ef7bc3163e686850f9196e2ba758b486b18743fd2487476976d6c55b826da2ab1a017ae854af0c53d4b95865a5221a387ba9ad11

Download Submit
memory/1188-52-0x00000000762A1000-0x00000000762A3000-memory.dmp

Filesize
8KB

Download
memory/1188-53-0x00000000003C0000-0x00000000003F4000-memory.dmp

Filesize
208KB

Download
memory/1188-58-0x0000000000D80000-0x0000000000DA3000-memory.dmp

Filesize
140KB

Download
memory/1188-56-0x0000000000D70000-0x0000000000DA3000-memory.dmp

Filesize
204KB

Download
memory/1188-59-0x0000000000380000-0x00000000003B1000-memory.dmp

Filesize
196KB

Download
memory/2000-60-0x0000000000000000-mapping.dmp

Download
memory/2000-63-0x00000000003A0000-0x00000000003D4000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads