emotet | 783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340

General

Target

783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340.exe
Size

568KB
MD5

9f471252b0669d62887c52f8feaf0b55
SHA1

0f1120faaf00317226c9cc739c0314045c540e0f
SHA256

783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340
SHA512

0ed77d4fa5c937a0ee382527de0dc4d8ccaea733cd0b70ed75cd4417dab99b8348fe9d56dde7a9c1bdb06b5d829b061dc4b00a0e58cd038b7a9ef49451a67d28

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

88.153.35.32:80

107.170.146.252:8080

173.212.214.235:7080

167.114.153.111:8080

202.141.243.254:443

75.143.247.51:80

85.105.111.166:80

216.139.123.119:80

113.61.66.94:80

162.241.140.129:8080

190.12.119.180:443

2.58.16.89:8080

91.211.88.52:7080

93.147.212.206:80

71.15.245.148:8080

157.245.99.39:8080

27.114.9.93:80

50.91.114.38:80

174.106.122.139:80

47.36.140.164:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet Payload 2 IoCs

Detects Emotet payload in memory.

Processes:

resource	yara_rule
behavioral1/memory/1048-70-0x0000000000360000-0x0000000000370000-memory.dmp	emotet
behavioral1/memory/1852-90-0x00000000003E0000-0x00000000003F0000-memory.dmp	emotet

Executes dropped EXE 1 IoCs

Processes:

ExplorerFrame.exe

pid process

1852 ExplorerFrame.exe

Drops file in System32 directory 1 IoCs

Processes:

783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\mswdat10\ExplorerFrame.exe	783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

ExplorerFrame.exe

pid	process
1852	ExplorerFrame.exe
1852	ExplorerFrame.exe
1852	ExplorerFrame.exe
1852	ExplorerFrame.exe
1852	ExplorerFrame.exe
1852	ExplorerFrame.exe
1852	ExplorerFrame.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340.exe

pid process

1048 783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340.exeExplorerFrame.exe

pid process

1048 783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340.exe
1852 ExplorerFrame.exe

pid	process
1048	783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340.exe

pid	process
1048	783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340.exe
1852	ExplorerFrame.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340.exe

description	pid	process	target process
PID 1048 wrote to memory of 1868	1048	783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340.exe	splwow64.exe
PID 1048 wrote to memory of 1868	1048	783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340.exe	splwow64.exe
PID 1048 wrote to memory of 1868	1048	783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340.exe	splwow64.exe
PID 1048 wrote to memory of 1868	1048	783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340.exe	splwow64.exe
PID 1048 wrote to memory of 1852	1048	783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340.exe	ExplorerFrame.exe
PID 1048 wrote to memory of 1852	1048	783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340.exe	ExplorerFrame.exe
PID 1048 wrote to memory of 1852	1048	783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340.exe	ExplorerFrame.exe
PID 1048 wrote to memory of 1852	1048	783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340.exe	ExplorerFrame.exe

C:\Users\Admin\AppData\Local\Temp\783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340.exe
"C:\Users\Admin\AppData\Local\Temp\783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1868
- C:\Windows\SysWOW64\mswdat10\ExplorerFrame.exe
  "C:\Windows\SysWOW64\mswdat10\ExplorerFrame.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mswdat10\ExplorerFrame.exe

MD5
9f471252b0669d62887c52f8feaf0b55

SHA1
0f1120faaf00317226c9cc739c0314045c540e0f

SHA256
783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340

SHA512
0ed77d4fa5c937a0ee382527de0dc4d8ccaea733cd0b70ed75cd4417dab99b8348fe9d56dde7a9c1bdb06b5d829b061dc4b00a0e58cd038b7a9ef49451a67d28

Download Submit
memory/1048-66-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1048-58-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1048-73-0x0000000074E61000-0x0000000074E63000-memory.dmp

Filesize
8KB

Download
memory/1048-60-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1048-61-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1048-62-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1048-63-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1048-57-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1048-64-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1048-65-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1048-67-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1048-68-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1048-69-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1048-70-0x0000000000360000-0x0000000000370000-memory.dmp

Filesize
64KB

Download
memory/1048-59-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1852-95-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1852-83-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1852-80-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1852-79-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1852-82-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1852-81-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1852-84-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1852-78-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1852-85-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1852-86-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1852-88-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1852-87-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1852-89-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1852-90-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/1852-94-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/1868-56-0x000007FEFB5B1000-0x000007FEFB5B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads