emotet | 296c281262ddf5ea42b2e91b3a3b49badd6b3373216208778534ecd476e56e49

General

Target

296c281262ddf5ea42b2e91b3a3b49badd6b3373216208778534ecd476e56e49.exe
Size

475KB
MD5

7ae0af9ced6b5bea9293bb9f3e4507c1
SHA1

1accc88c5734577075d1f0905dbaf76b8228ec5b
SHA256

296c281262ddf5ea42b2e91b3a3b49badd6b3373216208778534ecd476e56e49
SHA512

d412191d5452521cac82380f49be58ce56efe944922224196b4545df57344b1b79bf26c84450a699fe62331248fc04f8909517f670aa806b9dc9924891cf87bc

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

181.123.0.125:80

119.159.150.176:443

184.69.214.94:20

80.240.141.141:7080

185.187.198.10:8080

46.41.134.46:8080

178.249.187.151:8080

217.199.160.224:8080

186.83.133.253:8080

23.92.22.225:7080

212.71.237.140:8080

190.221.50.210:8080

187.199.158.226:443

185.86.148.222:8080

200.58.171.51:80

77.245.101.134:8080

201.163.74.202:443

203.25.159.3:8080

183.82.97.25:80

51.15.8.192:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

soundsmapi.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	soundsmapi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	soundsmapi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	soundsmapi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	soundsmapi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

soundsmapi.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	soundsmapi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	soundsmapi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	soundsmapi.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

soundsmapi.exe

pid process

532 soundsmapi.exe
532 soundsmapi.exe
532 soundsmapi.exe
532 soundsmapi.exe
532 soundsmapi.exe
532 soundsmapi.exe
532 soundsmapi.exe
532 soundsmapi.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

296c281262ddf5ea42b2e91b3a3b49badd6b3373216208778534ecd476e56e49.exe

pid process

4996 296c281262ddf5ea42b2e91b3a3b49badd6b3373216208778534ecd476e56e49.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 544 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 544 AUDIODG.EXE

pid	process
532	soundsmapi.exe
532	soundsmapi.exe
532	soundsmapi.exe
532	soundsmapi.exe
532	soundsmapi.exe
532	soundsmapi.exe
532	soundsmapi.exe
532	soundsmapi.exe

pid	process
4996	296c281262ddf5ea42b2e91b3a3b49badd6b3373216208778534ecd476e56e49.exe

description	pid	process
Token: 33	544	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	544	AUDIODG.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

296c281262ddf5ea42b2e91b3a3b49badd6b3373216208778534ecd476e56e49.exesoundsmapi.exe

description	pid	process	target process
PID 396 wrote to memory of 4996	396	296c281262ddf5ea42b2e91b3a3b49badd6b3373216208778534ecd476e56e49.exe	296c281262ddf5ea42b2e91b3a3b49badd6b3373216208778534ecd476e56e49.exe
PID 396 wrote to memory of 4996	396	296c281262ddf5ea42b2e91b3a3b49badd6b3373216208778534ecd476e56e49.exe	296c281262ddf5ea42b2e91b3a3b49badd6b3373216208778534ecd476e56e49.exe
PID 396 wrote to memory of 4996	396	296c281262ddf5ea42b2e91b3a3b49badd6b3373216208778534ecd476e56e49.exe	296c281262ddf5ea42b2e91b3a3b49badd6b3373216208778534ecd476e56e49.exe
PID 4444 wrote to memory of 532	4444	soundsmapi.exe	soundsmapi.exe
PID 4444 wrote to memory of 532	4444	soundsmapi.exe	soundsmapi.exe
PID 4444 wrote to memory of 532	4444	soundsmapi.exe	soundsmapi.exe

C:\Users\Admin\AppData\Local\Temp\296c281262ddf5ea42b2e91b3a3b49badd6b3373216208778534ecd476e56e49.exe
"C:\Users\Admin\AppData\Local\Temp\296c281262ddf5ea42b2e91b3a3b49badd6b3373216208778534ecd476e56e49.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:396

C:\Users\Admin\AppData\Local\Temp\296c281262ddf5ea42b2e91b3a3b49badd6b3373216208778534ecd476e56e49.exe
--b83f6d34
2⤵
- Suspicious behavior: RenamesItself
PID:4996

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x310 0x4d0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:544

C:\Windows\SysWOW64\soundsmapi.exe
"C:\Windows\SysWOW64\soundsmapi.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4444

C:\Windows\SysWOW64\soundsmapi.exe
--34414dc3
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:532

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/396-130-0x0000000000690000-0x00000000006A5000-memory.dmp

Filesize
84KB

Download
memory/396-132-0x0000000000690000-0x00000000006A5000-memory.dmp

Filesize
84KB

Download
memory/396-133-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/532-136-0x0000000000000000-mapping.dmp

Download
memory/532-138-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/532-139-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4996-131-0x0000000000000000-mapping.dmp

Download
memory/4996-134-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4996-135-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4996-137-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads