emotet | 4f75dfffe6bf68d62f6b2d638c511e301abd91d27075dbde4a6d11ba24aaa143

General

Target

4f75dfffe6bf68d62f6b2d638c511e301abd91d27075dbde4a6d11ba24aaa143.exe
Size

640KB
MD5

4de9c574bae78f3c6ef3bacfa6f28e56
SHA1

67b05fce9591c14bfbad9dc45fa1de68d0480bbc
SHA256

4f75dfffe6bf68d62f6b2d638c511e301abd91d27075dbde4a6d11ba24aaa143
SHA512

cfba2e390b6081c781c9b8328cef650c443caa5acf32af96c9f6cf5cf034b7c6acdc3b776008cbc3b8c535301aa9cf0a286070cd496f94effbef62e064b6c05f

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

82.225.49.121:80

120.138.30.150:8080

139.59.67.118:443

94.23.216.33:80

203.117.253.142:80

139.99.158.11:443

87.106.139.101:8080

190.160.53.126:80

5.39.91.110:7080

107.5.122.110:80

174.102.48.180:443

194.187.133.160:443

153.177.101.120:443

104.236.246.93:8080

78.24.219.147:8080

94.23.237.171:443

85.66.181.138:80

157.245.99.39:8080

201.173.217.124:443

91.211.88.52:7080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet Payload 5 IoCs

Detects Emotet payload in memory.

trojan banker

Processes:

resource	yara_rule
behavioral1/memory/1972-55-0x00000000002E0000-0x00000000002F2000-memory.dmp	emotet
behavioral1/memory/1972-59-0x0000000000310000-0x0000000000320000-memory.dmp	emotet
behavioral1/memory/1972-62-0x00000000002D0000-0x00000000002DF000-memory.dmp	emotet
behavioral1/memory/768-65-0x00000000002A0000-0x00000000002B2000-memory.dmp	emotet
behavioral1/memory/768-69-0x00000000002C0000-0x00000000002D0000-memory.dmp	emotet

Executes dropped EXE 1 IoCs

Processes:

d3dim700.exe

pid process

768 d3dim700.exe

pid	process
768	d3dim700.exe

Drops file in System32 directory 1 IoCs

Processes:

4f75dfffe6bf68d62f6b2d638c511e301abd91d27075dbde4a6d11ba24aaa143.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\panmap\d3dim700.exe	4f75dfffe6bf68d62f6b2d638c511e301abd91d27075dbde4a6d11ba24aaa143.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

d3dim700.exe

pid process

768 d3dim700.exe
768 d3dim700.exe
768 d3dim700.exe
768 d3dim700.exe
768 d3dim700.exe
768 d3dim700.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

4f75dfffe6bf68d62f6b2d638c511e301abd91d27075dbde4a6d11ba24aaa143.exe

pid process

1972 4f75dfffe6bf68d62f6b2d638c511e301abd91d27075dbde4a6d11ba24aaa143.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

4f75dfffe6bf68d62f6b2d638c511e301abd91d27075dbde4a6d11ba24aaa143.exed3dim700.exe

pid process

1972 4f75dfffe6bf68d62f6b2d638c511e301abd91d27075dbde4a6d11ba24aaa143.exe
768 d3dim700.exe

pid	process
768	d3dim700.exe
768	d3dim700.exe
768	d3dim700.exe
768	d3dim700.exe
768	d3dim700.exe
768	d3dim700.exe

pid	process
1972	4f75dfffe6bf68d62f6b2d638c511e301abd91d27075dbde4a6d11ba24aaa143.exe

pid	process
1972	4f75dfffe6bf68d62f6b2d638c511e301abd91d27075dbde4a6d11ba24aaa143.exe
768	d3dim700.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4f75dfffe6bf68d62f6b2d638c511e301abd91d27075dbde4a6d11ba24aaa143.exe

description	pid	process	target process
PID 1972 wrote to memory of 768	1972	4f75dfffe6bf68d62f6b2d638c511e301abd91d27075dbde4a6d11ba24aaa143.exe	d3dim700.exe
PID 1972 wrote to memory of 768	1972	4f75dfffe6bf68d62f6b2d638c511e301abd91d27075dbde4a6d11ba24aaa143.exe	d3dim700.exe
PID 1972 wrote to memory of 768	1972	4f75dfffe6bf68d62f6b2d638c511e301abd91d27075dbde4a6d11ba24aaa143.exe	d3dim700.exe
PID 1972 wrote to memory of 768	1972	4f75dfffe6bf68d62f6b2d638c511e301abd91d27075dbde4a6d11ba24aaa143.exe	d3dim700.exe

C:\Users\Admin\AppData\Local\Temp\4f75dfffe6bf68d62f6b2d638c511e301abd91d27075dbde4a6d11ba24aaa143.exe
"C:\Users\Admin\AppData\Local\Temp\4f75dfffe6bf68d62f6b2d638c511e301abd91d27075dbde4a6d11ba24aaa143.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\panmap\d3dim700.exe
  "C:\Windows\SysWOW64\panmap\d3dim700.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\panmap\d3dim700.exe

MD5
4de9c574bae78f3c6ef3bacfa6f28e56

SHA1
67b05fce9591c14bfbad9dc45fa1de68d0480bbc

SHA256
4f75dfffe6bf68d62f6b2d638c511e301abd91d27075dbde4a6d11ba24aaa143

SHA512
cfba2e390b6081c781c9b8328cef650c443caa5acf32af96c9f6cf5cf034b7c6acdc3b776008cbc3b8c535301aa9cf0a286070cd496f94effbef62e064b6c05f

Download Submit
memory/768-65-0x00000000002A0000-0x00000000002B2000-memory.dmp

Filesize
72KB

Download
memory/768-69-0x00000000002C0000-0x00000000002D0000-memory.dmp

Filesize
64KB

Download
memory/1972-54-0x0000000076BC1000-0x0000000076BC3000-memory.dmp

Filesize
8KB

Download
memory/1972-55-0x00000000002E0000-0x00000000002F2000-memory.dmp

Filesize
72KB

Download
memory/1972-59-0x0000000000310000-0x0000000000320000-memory.dmp

Filesize
64KB

Download
memory/1972-62-0x00000000002D0000-0x00000000002DF000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads