emotet | b9050ba74c3223dc34da20f62ec159ecd72d0c71674a8bcb3aba0e27ad2df4df

General

Target
emotet_exe_e5_b9050ba74c3223dc34da20f62ec159ecd72d0c71674a8bcb3aba0e27ad2df4df_2022-02-09__000853.dll
Size 575KB
Sample220209-af3tsagfb2
SHA256 b9050ba74c3223dc34da20f62ec159ecd72d0c71674a8bcb3aba0e27ad2df4df
MD5 3ee6b328fa65c5589b564d596138a4ed
SHA1 65c4c5383109905a54fa2d6b5ba9876c0721604b
SHA512 02f44fc56b4375d71f13678f2cd2946d3d86924fe7d854df5b3e51e1313f5a78ef6c23876c39df49e7c9925c52bf8bebefdc19fe89edbe2afc04bf75fcc6dd70
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

103.42.57.17:8080
93.104.208.37:8080
195.154.146.35:443
62.171.178.147:8080
37.59.209.141:8080
139.196.72.155:8080
37.44.244.177:8080
191.252.103.16:80
217.182.143.207:443
128.199.192.135:8080
103.41.204.169:8080
185.148.168.15:8080
168.197.250.14:80
78.46.73.125:443
194.9.172.107:8080
185.148.168.220:8080
118.98.72.86:443
54.37.106.167:8080
78.47.204.80:443
159.69.237.188:443
116.124.128.206:8080
59.148.253.194:443
85.214.67.203:8080
185.184.25.78:8080
173.203.78.138:443
54.37.228.122:443
198.199.98.78:8080
195.77.239.39:8080
210.57.209.142:8080
66.42.57.149:443
104.131.62.48:8080
54.38.242.185:443
190.90.233.66:443
207.148.81.119:8080
203.153.216.46:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1440	svchost.exe
Token: SeCreatePagefilePrivilege	1440	svchost.exe
Token: SeShutdownPrivilege	1440	svchost.exe
Token: SeCreatePagefilePrivilege	1440	svchost.exe
Token: SeShutdownPrivilege	1440	svchost.exe
Token: SeCreatePagefilePrivilege	1440	svchost.exe
Token: SeSecurityPrivilege	4140	TiWorker.exe
Token: SeRestorePrivilege	4140	TiWorker.exe
Token: SeBackupPrivilege	4140	TiWorker.exe
Token: SeBackupPrivilege	4140	TiWorker.exe
Token: SeRestorePrivilege	4140	TiWorker.exe
Token: SeSecurityPrivilege	4140	TiWorker.exe
Token: SeBackupPrivilege	4140	TiWorker.exe
Token: SeRestorePrivilege	4140	TiWorker.exe
Token: SeSecurityPrivilege	4140	TiWorker.exe
Token: SeBackupPrivilege	4140	TiWorker.exe
Token: SeRestorePrivilege	4140	TiWorker.exe
Token: SeSecurityPrivilege	4140	TiWorker.exe
Token: SeBackupPrivilege	4140	TiWorker.exe
Token: SeRestorePrivilege	4140	TiWorker.exe
Token: SeSecurityPrivilege	4140	TiWorker.exe
Token: SeBackupPrivilege	4140	TiWorker.exe
Token: SeRestorePrivilege	4140	TiWorker.exe
Token: SeSecurityPrivilege	4140	TiWorker.exe
Token: SeBackupPrivilege	4140	TiWorker.exe
Token: SeRestorePrivilege	4140	TiWorker.exe
Token: SeSecurityPrivilege	4140	TiWorker.exe
Token: SeBackupPrivilege	4140	TiWorker.exe
Token: SeRestorePrivilege	4140	TiWorker.exe
Token: SeSecurityPrivilege	4140	TiWorker.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 2120	1560	regsvr32.exe	84
PID 1560 wrote to memory of 2120	1560	regsvr32.exe	84
PID 1560 wrote to memory of 2120	1560	regsvr32.exe	84
PID 2120 wrote to memory of 4544	2120	regsvr32.exe	85
PID 2120 wrote to memory of 4544	2120	regsvr32.exe	85
PID 2120 wrote to memory of 4544	2120	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_b9050ba74c3223dc34da20f62ec159ecd72d0c71674a8bcb3aba0e27ad2df4df_2022-02-09__000853.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_b9050ba74c3223dc34da20f62ec159ecd72d0c71674a8bcb3aba0e27ad2df4df_2022-02-09__000853.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_b9050ba74c3223dc34da20f62ec159ecd72d0c71674a8bcb3aba0e27ad2df4df_2022-02-09__000853.dll",DllRegisterServer
    3⤵
    PID:4544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1440

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1440-132-0x000002B309B20000-0x000002B309B30000-memory.dmp

Download

memory/1440-133-0x000002B309B80000-0x000002B309B90000-memory.dmp

Download

memory/1440-134-0x000002B30C250000-0x000002B30C254000-memory.dmp

Download

memory/2120-130-0x0000000010000000-0x0000000010025000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads