emotet | a3a1af592b33bbf757eb527d3434bd9f2cc48d314f65c2021ed1cf9a092e7fae

General

Target
e878de8cc243503803f6000cb756673e.dll
Size 664KB
Sample220316-pvmtfadgd2
SHA256 a3a1af592b33bbf757eb527d3434bd9f2cc48d314f65c2021ed1cf9a092e7fae
MD5 e878de8cc243503803f6000cb756673e
SHA1 12d459e547225058994fa9bf53d72a056954a3e8
SHA512 f5f417308ae7b019fb5c97f575afc1aff00ee16568c7aa252d23ab5e3fe5e079265299e4c0a84df5b66f2bd4cf745e693c925bd53cc4193025dd064e51c70d89
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

165.22.61.235:443
121.78.112.42:8080
216.10.251.121:8080
195.77.239.39:8080
195.154.146.35:443
68.183.93.250:443
139.196.72.155:8080
194.9.172.107:8080
196.44.98.190:8080
128.199.192.135:8080
5.56.132.177:8080
78.46.73.125:443
87.106.97.83:7080
66.42.57.149:443
37.44.244.177:8080
190.90.233.66:443
203.153.216.46:443
207.148.81.119:8080
103.41.204.169:8080
104.131.62.48:8080
185.148.168.15:8080
217.182.143.207:443
198.199.98.78:8080
103.82.248.59:7080
185.168.130.138:443
202.28.34.99:8080
59.148.253.194:443
37.59.209.141:8080
185.148.168.220:8080
54.37.228.122:443
85.214.67.203:8080
85.25.120.45:8080
118.98.72.86:443
103.42.58.120:7080
78.47.204.80:443
202.134.4.210:7080
93.104.209.107:8080
2.58.16.87:8080
62.171.178.147:8080
45.71.195.104:8080
116.124.128.206:8080
191.252.103.16:80
54.37.106.167:8080
88.217.172.165:8080
54.38.242.185:443
210.57.209.142:8080
159.69.237.188:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
2312	regsvr32.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F17ED7F9-8C39-41D8-A8CF-02CA2E1518AB}.catalogItem	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Rtnltqup\kzxlkq.tov	regsvr32.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F2862EA1-8424-4055-BAD3-7C649B331995}.catalogItem	svchost.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "00180008057770E1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\00180008057770E1 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e00000000020000000000106600000001000020000000713cddb2269c2be79586a7f78463dd8bfbde8f8562199ae5aa42fce0a0e7a1f3000000000e80000000020000200000008090a39bcbd41ffed96c53154cb1e12c08cb633429f57062a5cb81f770b5038880000000cadc1bd6f4c2d97f5bfd38afd9ad0bfe06c45aac216f1474bdd5c9c5eb0194cf59ccfd53aa10ef6137b2300f593d33166cc4db24b742116d5feb5eb84b693f3e1770500da1f93ea368dac3ab79df4fe70296ec493ead196fdf0ff4f2b273b71dc45316597ab21f95e77a4032a029e0a44d55be05e4161c7749924c4db15c711640000000a8f9b01a99ca93136486fcadf0bf79fcbbc3fa382124a1d2f08e6c7c040dbd4bac0946d37db824a196600816e9d0311daeec02d8835647f346e034b8cc6abb92	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e00000000020000000000106600000001000020000000c02c222b4ec169b9717adb30de420cefe681911d2178823f1cbb79441c89d1f9000000000e8000000002000020000000cd31b27889fdf1f6a86e001d431acd5aff36fa4034e96be81efa35bb477ec763100d00001f62a5eb45281d5faa84b6f22138f9ec1ea0e9028c4d0211f1312ef2bea530831d48aa8976ad9755bca30665003b8de0e63bf53c6954ab6d22498333ca80f02eb32cf176dfd3ad05d1f7ae4c517188c5ce26733873d2dd7d9d6323ca57fbac7a4807de19680439de890f73172011b3488437fe850a5544e1494ccd3318577033148abd20a10cfbe8dee7ba005202205fab99a9805dba0d64733fedceb6e7130f65ea7094ebbcba1f323a66459b26777a058649c36fbe4f8e0eaabe8cfbaf5e640749182d910a119805e0339efa4bc3fcb4ff3b7139d019d87b47894248931fd0befbced90110d1759fba8ff2601a17f8f2048c533d0cfdd5051d06803096eb9d69a47ecf05804bb63a4c38f67a88291b8c1c2d8a7bba6294b9a26f5fe759a617b3756dddcacfe9b90b1e669d6584c76ddc73b21c442b52ad53bf2e7ee33f59c672b3fd272b886d447b9b0e439622dc0ed4f0447759b02682a85af7f37df9a711124ece8566e8d73231c74561e2c780aeb99e18599fb4cb9cee175c7cdd42338d0095663a58d7965cf82745f3e8c2b878c7548e55029641ec8a3964dcbf00fa9bf4c78a48c8eb414f14197023ebe8d0371db67b5d039732e42d13d3f6f0d164726dcd53a385bd97851041f0a12e04a71177957187cf39f6859c5fda3c233ed0f7cd95011f3599e612d229333db4cfc8655009c2c70ac353d8f9929eef24c5f2347f693d82b90513edf4c917053b0991d918b5a8b6474522df7d3889819b06c5a952a216700e16cec2d88eb971a938a8af8cd80488ab3cb7a667da4b66b10390e24f9f72bee3b75f213b0a29c632a0b5185d11f38aa4fa4f526d51f3a2caae3b56346b5458dd739bb3b5bd1f34e4f141de093c31969af4cc44d9bbc88505ec203d5f6b45fd1205b372f18af6cf551110223ba0b201a9f0bae5001159b13667184c5dad467bb53396c1800211e439a88dfefda85ddbc854e31c4dba3280b4799495aef3478b83082019b3b9b08a2f12dc0a566f0c1cfae3cd9cee053ae53818a840cea5a051e4976b54301c5dafae6157f3b94115143150163582e34a9bf2e69a7e9a08078430e2f69401173b4eb15a3c0d14405050dce716a4a204a44e7c62db4681afccf81fe4d3cac020dfb8b4054537912b1e787a89e02e28472dfa01b08f7140c8002ad9f8db95cebbb9d12bdbf500bdbabb001db2e0c826b60f3164451c1f48fcb15665b380ee1e49e83d204861d8a45588fa68954f1e8bb4210ef531bebc09b8d3f28bbae1c0a88334c2fcbddfe7aad88e7c68dd6eb81d36f6640c70ac40ca188ec02a952e1f1ca35f699301e9015e732fcd6cc24aa4c71008e386f1a020af5af1f5963ca83dae1323297dba06e2fe232b105fe0b043a390004a10b9b43fb0d2664e248473626069cf06d4b11ed70063ffb19b527614617c567d60c4ecd4ada86fd7548f3c09d550cde4bd5cb93b015fabb6ca6f6c8f4b57c642131a4e3ec11ef94e1dd877eeb5aaea7cdba387641fdd2279e53c996eb4c40d26bb3e87f074eb4ea97624e7232eee6838726daa9ba9f26e2f1dcfa586fc255cfe66e9baae9c3ddeb1b8141cfd279c7794b85fde3eccb419f851fee1c00a9ecdad933cfc8f88bcf0618767e6e0cea987168351eac0015977185c97d8b96536ed55d264a423d2bbaf574a60d9e9210b479dc12def9219f21bb3fdf8836504da02078abfda82cdfb7bba693fcc5650782ea6409c24143ff3ceca21c7b2d489da7b07f49d1daef573f152f04d672dd5da7384ad6c5483c798ceb21fd8060acf70fce090aa6cf2c09773143404fa834b5f983701d974d243d737d9435f8c68cf3943d9139b5a79b9ef77ebdc74db0d14c66208f073a5525e041d7317e56b731c7b7080a524fabee58263888af4690ad88cf80516fe9095fad8ffc297771504a2a02e2f98bf8b39f18d390a18a297e74887133a534efa3257bf65b912f4c87902d8dcb30471f62e34ad91f041df455c576ee615fd785e7b64613a8d527b7a18811c27c3abfce853d1862cab4522c23bca23a34d41ce3547aa22b49be773a0de6892a6d16dce4a0b6d862e89ebacdd5bc91cc1fbe4e73d61ecafafce0a1dd802d9547720ab350cf1600011c8b0fbca5bf87d6113f8593b231fa139d388b3ae9b1010af0c17ddc34c4407ce8e2d3e056586dfdc982bb3dc51e1a0d87f67b011dab4281e0a53b535195471526b1758d5f3e35282cc67a619829f37e6d5e79cd17bdd0d89c7cb7fce187e3bad91aa14ffbc7a8e3d5c14f319c9722db8e7ccd108b4bf84b5f8674bf3b5176749cb7d3541ef0e2559e9b8402593b28f7dd977ed9437dce6ab93729e48d4bcb70dd8a49bd493a8013bf988787861a3c05d3bc8b88777dd996422bda36064a3763d24c590983d7be2006fbf877a6ed7cd81b397bd8b0e5adaa33314e534d2cd8e10fbd921bb6ba674ce29c665de999a89f5b1c87fde0daff03571655c476a9429c7ce172a92b1b9b2448dee166d4f9609f29a75b06e5dec58b91258a419369198bfbc46d69a2d84703e42b90d3483ae55368981d91e6d868b402ffca19ab23a79a8327003fb7e8926804af9be2dd56bb99bfa57431bf476e21f3b088d6366922544f4b0955bd959340159dfdb15e0e5241e6ae3b2c07113fc4b6a8df8cbf187d4e89f38aadc899328fd20d9995199ce3259e8a5f0e22fd692b8e7c990046d251fbcad1543fac1257073d9a37ace17600331d29cd25eb7a6b69d5a79040ad0fb30e669f3c18a8735d73a232b768d979a47a668dd0c9b7bf59221b10b4290e6dd0d2526f8730dfd9301a027bcb2d51c139ff25e21289fd707d3efaa8a1a6326b3f726b39289a5227c03b52548021ad9278b402d0766cd98848ee1cf7effdfd37fb731133c75edde0f2aa5e87f1398e08faf109b45a4f836c34728708e50957b15dad7b8a1d439045213f4ea959706b80ef5df25dab5b50902fafcb09d7540d90aa2f65ea84d26e81e9cac2b09caf1d06f362a0bd49f3ca6530f0033502be3ab2b3beee39c3fa6785411544d0da1e793dfbe68764027aff5e118f465b7bb312275a12747b4d737ae929c10234d2b99d960b016a62ce5df6050ed827da7f2f99eece61bff47118112ac1df638ba237ba2064ab44f6dc087cde87e1de90b047a5d4509919363e913d1ef3bc0baebe6ba48decf516cccfeff175195ca9592ef9e23d39096e531dc50a0cc54d3c9d1a20c825962cd3e6ea47aaa81dd951cdc3bc5f08acba5ec83bdecf0ced3a035313deea9dd8c6d876b20fff1c7663191c0a0107860139e40c94534640101f02c2942d11ef78542f0d25037242cf7197f3ce78996ad10bccd3bcc321e4bc97cbef0dbe0b127670bc3b87633f344b81b22af9261f031d94b570f529772d25e7497764e32eee709871b9c86ded04b3a97365210604c9a1f27fb1ee8c45b20f4a89e2a9bb2da899dc2a328cd90225eec50105504dee3654a3bed8ce4c61add18df6bf9b8c6e366c77d67827b2164bb582f48c0c136dc1e81fc5c81de57fbff03671a375dd293f33d03be11785938dd2c64b9fdb1df31418faf816095014752b7cc822a9c4be95db2da4637239ba8d2afa3afdb7cca17de0055a47be1a0facde41ed379b8fa21bbc3de8f04f9406d5e83bcd4b4e6deb56c7e97cc0264d66f6c121c6dafffe04fa7a65b125c4297feec2bb408d73566c8a1754c4c2147bf61ce52339d22e5f0f3912bd2bbda408def4e22ae017f7a89ac301e5dc80cb9f6452329fe4ab417cd50c939dc09ab3682d07a89561bfa8bf50d67ecd11486adbe68c2a23e058165d5f098ffc7cb22d0747f668384d42cdcd25544285ab2f1390afee9c11e1452b1b87303593d5d974f807cf3576298f368c44dd042bbb96fd81c93370c93e00aa2feed476472752fb43bd50c71ac6a64bd7f7a74358c854bbdbb03565c9bcb075da7d681f42dc34028ceb6ccbf55aef1b842f9ece4cdb8345978a5e99707dd84b491e43d0977b6cdd1c1421af9b097863556a56f7c6377e8de059d7ea56271dc94ff224c131d1f7387598d466643152d1d151bab8762d0d0883d4b5f3da40799360c9219e60840c0fdce31d48c123f24ed0431b2eb4524ef4c2120b87d9cdb6751d47bb3ed3e5bf1299ed5b43400037ebc4772b93b3fb5b833cac93f16dff435b6d36a510ff71d3b0857130b7b66cf12f183b4763efc7975084f5acaa1f63fa93e32ed0a70f8d303d0abdeee98ce0a3e0fc0555cd5a0ed25ec202823fce7cf664ad785721f1ae83e611f9a1010dfcd3a39b4e8bf50eac52970501f8e72642783a966f37c8952a2a4c51a4c104e0ffc177c255363aaecf74993e474b666f1b698c4bb77803ef5af347dd645d7be17703ec43c97ce0cd7cfd34829cfcd53574c9e5c2b497caee496534144e66bf369a4eb081f86f905e7fc0252e4123c8677b399184c2d7f4f87111801d78c7c866f3637bc5d8545bf2db138ff668f2d31e51bfee775b7f7fc2a9850a77d880459fd082f9e512a1366ec9e2d2b53209aedf65aeb3f9d1b62cc4925453b49af892b634b506311788624d72f8c9aa14beab3d46e64c11cf02ab7eb7bc3fd4d417542990500d5dbc475e983ee693fb83a831007e40ed0d235cb608e7e91da9a402d75801f8bf74ba6e028e09c3cdd0da2018e532960bfc24a8a495e9ff38ddfb106ba3fdc5781a8960cecc83f211d8ce915085e76d418501440000000b079eea08a4c5cfe9d2510da3f92f4b3ece2580ff14af546d1ca655ba416fa0f19fdd23269e43ce5418ec90776757882f14125ddf2b4946b2d82396a0743c174	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2312	regsvr32.exe
2312	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4384	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 4384	3296	regsvr32.exe	81
PID 3296 wrote to memory of 4384	3296	regsvr32.exe	81
PID 3296 wrote to memory of 4384	3296	regsvr32.exe	81
PID 4384 wrote to memory of 2312	4384	regsvr32.exe	92
PID 4384 wrote to memory of 2312	4384	regsvr32.exe	92
PID 4384 wrote to memory of 2312	4384	regsvr32.exe	92

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e878de8cc243503803f6000cb756673e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e878de8cc243503803f6000cb756673e.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Rtnltqup\kzxlkq.tov"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2312

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:3532

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
- Modifies data under HKEY_USERS
PID:4400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2312-139-0x0000000000A00000-0x0000000000A34000-memory.dmp

Download

memory/4384-134-0x0000000002FA0000-0x0000000002FD4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads