emotet | 8b7c72262d30ac1b5f68f30f4b6c7d623968d91da08d32c2628a38074b23ab87

General

Target

8b7c72262d30ac1b5f68f30f4b6c7d623968d91da08d32c2628a38074b23ab87.exe
Size

476KB
MD5

4b0eea4ab9295b29359ba65024a4de59
SHA1

f739ff1be834c98e771db66a71aee5c76f1dd159
SHA256

8b7c72262d30ac1b5f68f30f4b6c7d623968d91da08d32c2628a38074b23ab87
SHA512

d10f7923d88d831ecba412551c9a3a0c33c8302dafcc147d09531a29eecadd1ecdb5d35499e825243cb2660ce0b4c1eba0af404de933b2b725ac4ad7e90be034

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

68.44.137.144:443

82.223.70.24:8080

101.187.104.105:80

178.20.74.212:80

98.15.140.226:80

209.97.168.52:8080

74.208.45.104:8080

169.239.182.217:8080

176.111.60.55:8080

87.106.136.232:8080

46.105.131.69:443

93.51.50.171:8080

62.75.187.192:8080

185.94.252.104:443

190.160.53.126:80

50.116.86.205:8080

80.102.134.174:8080

110.145.77.103:80

113.160.130.116:8443

60.130.173.117:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Executes dropped EXE 1 IoCs

Processes:

NlsLexicons0013.exe

pid process

764 NlsLexicons0013.exe

pid	process
764	NlsLexicons0013.exe

Drops file in System32 directory 1 IoCs

Processes:

8b7c72262d30ac1b5f68f30f4b6c7d623968d91da08d32c2628a38074b23ab87.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\mciseq\NlsLexicons0013.exe	8b7c72262d30ac1b5f68f30f4b6c7d623968d91da08d32c2628a38074b23ab87.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

NlsLexicons0013.exe

pid process

764 NlsLexicons0013.exe
764 NlsLexicons0013.exe
764 NlsLexicons0013.exe
764 NlsLexicons0013.exe
764 NlsLexicons0013.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

8b7c72262d30ac1b5f68f30f4b6c7d623968d91da08d32c2628a38074b23ab87.exe

pid process

1976 8b7c72262d30ac1b5f68f30f4b6c7d623968d91da08d32c2628a38074b23ab87.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

8b7c72262d30ac1b5f68f30f4b6c7d623968d91da08d32c2628a38074b23ab87.exeNlsLexicons0013.exe

pid process

1976 8b7c72262d30ac1b5f68f30f4b6c7d623968d91da08d32c2628a38074b23ab87.exe
764 NlsLexicons0013.exe

pid	process
764	NlsLexicons0013.exe
764	NlsLexicons0013.exe
764	NlsLexicons0013.exe
764	NlsLexicons0013.exe
764	NlsLexicons0013.exe

pid	process
1976	8b7c72262d30ac1b5f68f30f4b6c7d623968d91da08d32c2628a38074b23ab87.exe

pid	process
1976	8b7c72262d30ac1b5f68f30f4b6c7d623968d91da08d32c2628a38074b23ab87.exe
764	NlsLexicons0013.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8b7c72262d30ac1b5f68f30f4b6c7d623968d91da08d32c2628a38074b23ab87.exe

description	pid	process	target process
PID 1976 wrote to memory of 764	1976	8b7c72262d30ac1b5f68f30f4b6c7d623968d91da08d32c2628a38074b23ab87.exe	NlsLexicons0013.exe
PID 1976 wrote to memory of 764	1976	8b7c72262d30ac1b5f68f30f4b6c7d623968d91da08d32c2628a38074b23ab87.exe	NlsLexicons0013.exe
PID 1976 wrote to memory of 764	1976	8b7c72262d30ac1b5f68f30f4b6c7d623968d91da08d32c2628a38074b23ab87.exe	NlsLexicons0013.exe
PID 1976 wrote to memory of 764	1976	8b7c72262d30ac1b5f68f30f4b6c7d623968d91da08d32c2628a38074b23ab87.exe	NlsLexicons0013.exe

C:\Users\Admin\AppData\Local\Temp\8b7c72262d30ac1b5f68f30f4b6c7d623968d91da08d32c2628a38074b23ab87.exe
"C:\Users\Admin\AppData\Local\Temp\8b7c72262d30ac1b5f68f30f4b6c7d623968d91da08d32c2628a38074b23ab87.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\mciseq\NlsLexicons0013.exe
"C:\Windows\SysWOW64\mciseq\NlsLexicons0013.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:764

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mciseq\NlsLexicons0013.exe
MD5
4b0eea4ab9295b29359ba65024a4de59

SHA1
f739ff1be834c98e771db66a71aee5c76f1dd159

SHA256
8b7c72262d30ac1b5f68f30f4b6c7d623968d91da08d32c2628a38074b23ab87

SHA512
d10f7923d88d831ecba412551c9a3a0c33c8302dafcc147d09531a29eecadd1ecdb5d35499e825243cb2660ce0b4c1eba0af404de933b2b725ac4ad7e90be034

Download Submit
memory/764-61-0x00000000002B0000-0x00000000002BC000-memory.dmp

Filesize
48KB

Download
memory/1976-54-0x0000000075641000-0x0000000075643000-memory.dmp

Filesize
8KB

Download
memory/1976-55-0x0000000000230000-0x000000000023C000-memory.dmp

Filesize
48KB

Download
memory/1976-58-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing