emotet | 3bebc167adc5cfc6df3e052fcc56cca0c5d91d30fe2791b2a5a6485878c3b2f1

General

Target

3bebc167adc5cfc6df3e052fcc56cca0c5d91d30fe2791b2a5a6485878c3b2f1.exe
Size

329KB
MD5

cc269eb719302c38ae0df44ca4833024
SHA1

d1d22fd4ea2a90099fdc76c0b2d150d61c2aef6b
SHA256

3bebc167adc5cfc6df3e052fcc56cca0c5d91d30fe2791b2a5a6485878c3b2f1
SHA512

a0ee73595b15f9e9b686b1206c71739992ca0c39792e086d3ce1b1cd4499beb01a15708c19f689dd38471759c49244b52e865ccb2473da9d8213cd4b6069200b

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

186.4.172.5:443

117.197.124.36:443

37.208.39.59:7080

186.4.172.5:8080

182.176.106.43:995

178.62.37.188:443

92.51.129.249:4143

92.222.125.16:7080

142.44.162.209:8080

31.12.67.62:7080

46.105.131.87:80

92.222.216.44:8080

87.106.136.232:8080

103.97.95.218:143

190.145.67.134:8090

104.236.246.93:8080

88.156.97.210:80

175.100.138.82:22

78.24.219.147:8080

91.205.215.66:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

nextdrawa.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	nextdrawa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

nextdrawa.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	nextdrawa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	nextdrawa.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0094000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	nextdrawa.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{88B295A5-0AEA-43FD-A52B-69F1BB33E05E}\WpadDecisionTime = 80d2c0d71b6fd801	nextdrawa.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{88B295A5-0AEA-43FD-A52B-69F1BB33E05E}\WpadNetworkName = "Network 2"	nextdrawa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{88B295A5-0AEA-43FD-A52B-69F1BB33E05E}\12-9c-46-85-ff-ff	nextdrawa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-9c-46-85-ff-ff\WpadDecision = "0"	nextdrawa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	nextdrawa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-9c-46-85-ff-ff\WpadDecisionReason = "1"	nextdrawa.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	nextdrawa.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	nextdrawa.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	nextdrawa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	nextdrawa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{88B295A5-0AEA-43FD-A52B-69F1BB33E05E}\WpadDecisionReason = "1"	nextdrawa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-9c-46-85-ff-ff	nextdrawa.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	nextdrawa.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	nextdrawa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	nextdrawa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{88B295A5-0AEA-43FD-A52B-69F1BB33E05E}	nextdrawa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{88B295A5-0AEA-43FD-A52B-69F1BB33E05E}\WpadDecision = "0"	nextdrawa.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-9c-46-85-ff-ff\WpadDecisionTime = 80d2c0d71b6fd801	nextdrawa.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

nextdrawa.exe

pid process

1668 nextdrawa.exe
1668 nextdrawa.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

3bebc167adc5cfc6df3e052fcc56cca0c5d91d30fe2791b2a5a6485878c3b2f1.exe

pid process

1724 3bebc167adc5cfc6df3e052fcc56cca0c5d91d30fe2791b2a5a6485878c3b2f1.exe

pid	process
1668	nextdrawa.exe
1668	nextdrawa.exe

pid	process
1724	3bebc167adc5cfc6df3e052fcc56cca0c5d91d30fe2791b2a5a6485878c3b2f1.exe

Suspicious use of UnmapMainImage 4 IoCs

Processes:

3bebc167adc5cfc6df3e052fcc56cca0c5d91d30fe2791b2a5a6485878c3b2f1.exe3bebc167adc5cfc6df3e052fcc56cca0c5d91d30fe2791b2a5a6485878c3b2f1.exenextdrawa.exenextdrawa.exe

pid	process
1064	3bebc167adc5cfc6df3e052fcc56cca0c5d91d30fe2791b2a5a6485878c3b2f1.exe
1724	3bebc167adc5cfc6df3e052fcc56cca0c5d91d30fe2791b2a5a6485878c3b2f1.exe
1784	nextdrawa.exe
1668	nextdrawa.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

3bebc167adc5cfc6df3e052fcc56cca0c5d91d30fe2791b2a5a6485878c3b2f1.exenextdrawa.exe

description	pid	process	target process
PID 1064 wrote to memory of 1724	1064	3bebc167adc5cfc6df3e052fcc56cca0c5d91d30fe2791b2a5a6485878c3b2f1.exe	3bebc167adc5cfc6df3e052fcc56cca0c5d91d30fe2791b2a5a6485878c3b2f1.exe
PID 1064 wrote to memory of 1724	1064	3bebc167adc5cfc6df3e052fcc56cca0c5d91d30fe2791b2a5a6485878c3b2f1.exe	3bebc167adc5cfc6df3e052fcc56cca0c5d91d30fe2791b2a5a6485878c3b2f1.exe
PID 1064 wrote to memory of 1724	1064	3bebc167adc5cfc6df3e052fcc56cca0c5d91d30fe2791b2a5a6485878c3b2f1.exe	3bebc167adc5cfc6df3e052fcc56cca0c5d91d30fe2791b2a5a6485878c3b2f1.exe
PID 1064 wrote to memory of 1724	1064	3bebc167adc5cfc6df3e052fcc56cca0c5d91d30fe2791b2a5a6485878c3b2f1.exe	3bebc167adc5cfc6df3e052fcc56cca0c5d91d30fe2791b2a5a6485878c3b2f1.exe
PID 1784 wrote to memory of 1668	1784	nextdrawa.exe	nextdrawa.exe
PID 1784 wrote to memory of 1668	1784	nextdrawa.exe	nextdrawa.exe
PID 1784 wrote to memory of 1668	1784	nextdrawa.exe	nextdrawa.exe
PID 1784 wrote to memory of 1668	1784	nextdrawa.exe	nextdrawa.exe

C:\Users\Admin\AppData\Local\Temp\3bebc167adc5cfc6df3e052fcc56cca0c5d91d30fe2791b2a5a6485878c3b2f1.exe
"C:\Users\Admin\AppData\Local\Temp\3bebc167adc5cfc6df3e052fcc56cca0c5d91d30fe2791b2a5a6485878c3b2f1.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1064

C:\Users\Admin\AppData\Local\Temp\3bebc167adc5cfc6df3e052fcc56cca0c5d91d30fe2791b2a5a6485878c3b2f1.exe
--cc5ff026
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:1724

C:\Windows\SysWOW64\nextdrawa.exe
"C:\Windows\SysWOW64\nextdrawa.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\SysWOW64\nextdrawa.exe
--72ce4c80
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1668

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1064-54-0x00000000769D1000-0x00000000769D3000-memory.dmp

Filesize
8KB

Download
memory/1064-56-0x00000000001B0000-0x00000000001C3000-memory.dmp

Filesize
76KB

Download
memory/1064-58-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1668-61-0x0000000000000000-mapping.dmp

Download
memory/1668-63-0x00000000001B0000-0x00000000001C3000-memory.dmp

Filesize
76KB

Download
memory/1724-55-0x0000000000000000-mapping.dmp

Download
memory/1724-59-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads