emotet | 8c0e0ee03816ed18e26159135961f7bcce45cddad924b4471bb8a269e6ed7e71

General

Target

8c0e0ee03816ed18e26159135961f7bcce45cddad924b4471bb8a269e6ed7e71.exe
Size

400KB
MD5

eacf36f06fe703ffb7fd81121d7282fa
SHA1

0bcbeaf796855fcb96f7b1463e55a861db4d1dc5
SHA256

8c0e0ee03816ed18e26159135961f7bcce45cddad924b4471bb8a269e6ed7e71
SHA512

4f347466264b79b4cfede09bdbdccf99156a0c560fa15f49af664106017aaf5561ddfd53db6f3cba8283ff62d39e8154c318e818f3d2f83f76d771e1d6ee0bce

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

102.182.145.130:80

173.173.254.105:80

64.207.182.168:8080

51.89.199.141:8080

167.114.153.111:8080

173.63.222.65:80

218.147.193.146:80

59.125.219.109:443

172.104.97.173:8080

190.162.215.233:80

68.115.186.26:80

78.188.106.53:443

190.240.194.77:443

24.133.106.23:80

80.227.52.78:80

79.137.83.50:443

120.150.218.241:443

62.171.142.179:8080

194.4.58.192:7080

62.30.7.67:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet Payload 2 IoCs

Detects Emotet payload in memory.

Processes:

resource	yara_rule
behavioral1/memory/1828-70-0x00000000003F0000-0x0000000000400000-memory.dmp	emotet
behavioral1/memory/560-91-0x0000000000310000-0x0000000000320000-memory.dmp	emotet

Executes dropped EXE 1 IoCs

Processes:

OnLineIDCpl.exe

pid process

560 OnLineIDCpl.exe

pid	process
560	OnLineIDCpl.exe

Drops file in System32 directory 1 IoCs

Processes:

8c0e0ee03816ed18e26159135961f7bcce45cddad924b4471bb8a269e6ed7e71.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\mstsc\OnLineIDCpl.exe	8c0e0ee03816ed18e26159135961f7bcce45cddad924b4471bb8a269e6ed7e71.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

OnLineIDCpl.exe

pid process

560 OnLineIDCpl.exe
560 OnLineIDCpl.exe
560 OnLineIDCpl.exe
560 OnLineIDCpl.exe
560 OnLineIDCpl.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

8c0e0ee03816ed18e26159135961f7bcce45cddad924b4471bb8a269e6ed7e71.exe

pid process

1828 8c0e0ee03816ed18e26159135961f7bcce45cddad924b4471bb8a269e6ed7e71.exe

pid	process
560	OnLineIDCpl.exe
560	OnLineIDCpl.exe
560	OnLineIDCpl.exe
560	OnLineIDCpl.exe
560	OnLineIDCpl.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

8c0e0ee03816ed18e26159135961f7bcce45cddad924b4471bb8a269e6ed7e71.exeOnLineIDCpl.exe

pid	process
1828	8c0e0ee03816ed18e26159135961f7bcce45cddad924b4471bb8a269e6ed7e71.exe
1828	8c0e0ee03816ed18e26159135961f7bcce45cddad924b4471bb8a269e6ed7e71.exe
560	OnLineIDCpl.exe
560	OnLineIDCpl.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8c0e0ee03816ed18e26159135961f7bcce45cddad924b4471bb8a269e6ed7e71.exe

description	pid	process	target process
PID 1828 wrote to memory of 560	1828	8c0e0ee03816ed18e26159135961f7bcce45cddad924b4471bb8a269e6ed7e71.exe	OnLineIDCpl.exe
PID 1828 wrote to memory of 560	1828	8c0e0ee03816ed18e26159135961f7bcce45cddad924b4471bb8a269e6ed7e71.exe	OnLineIDCpl.exe
PID 1828 wrote to memory of 560	1828	8c0e0ee03816ed18e26159135961f7bcce45cddad924b4471bb8a269e6ed7e71.exe	OnLineIDCpl.exe
PID 1828 wrote to memory of 560	1828	8c0e0ee03816ed18e26159135961f7bcce45cddad924b4471bb8a269e6ed7e71.exe	OnLineIDCpl.exe

C:\Users\Admin\AppData\Local\Temp\8c0e0ee03816ed18e26159135961f7bcce45cddad924b4471bb8a269e6ed7e71.exe
"C:\Users\Admin\AppData\Local\Temp\8c0e0ee03816ed18e26159135961f7bcce45cddad924b4471bb8a269e6ed7e71.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\mstsc\OnLineIDCpl.exe
  "C:\Windows\SysWOW64\mstsc\OnLineIDCpl.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mstsc\OnLineIDCpl.exe

MD5
eacf36f06fe703ffb7fd81121d7282fa

SHA1
0bcbeaf796855fcb96f7b1463e55a861db4d1dc5

SHA256
8c0e0ee03816ed18e26159135961f7bcce45cddad924b4471bb8a269e6ed7e71

SHA512
4f347466264b79b4cfede09bdbdccf99156a0c560fa15f49af664106017aaf5561ddfd53db6f3cba8283ff62d39e8154c318e818f3d2f83f76d771e1d6ee0bce

Download Submit
memory/560-86-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/560-85-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/560-91-0x0000000000310000-0x0000000000320000-memory.dmp

Filesize
64KB

Download
memory/560-90-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/560-89-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/560-88-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/560-96-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/560-79-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/560-87-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/560-84-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/560-83-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/560-82-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/560-81-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/560-80-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/560-95-0x0000000000429000-0x000000000042A000-memory.dmp

Filesize
4KB

Download
memory/1828-63-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1828-73-0x00000000759B1000-0x00000000759B3000-memory.dmp

Filesize
8KB

Download
memory/1828-70-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/1828-69-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1828-68-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1828-66-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1828-67-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1828-65-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1828-57-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1828-64-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1828-62-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1828-61-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1828-58-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1828-60-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1828-59-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads