emotet | e59e7db0c75cef4bb6e057d725bae7ed5e13fd011b54fe39c3fe7cdb123b684f

Analysis

max time kernel
295s
max time network
307s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-06-2022 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

428ff553b67cd782e6d0227ae09c83ba8074fa11cf4bfd91703b2043aa5f6c50.exe
Size

342KB
MD5

f4853c12c2e213979b03701b36e18960
SHA1

925203dea145358e1457bca76de0edcae8b33961
SHA256

428ff553b67cd782e6d0227ae09c83ba8074fa11cf4bfd91703b2043aa5f6c50
SHA512

2c450e424f88ed9c3e37c03c2f4cc8153392b70320ec5533d17a5e10400c70ec668f8526ea3125364ce7d9eba7dc16295d0587e93c979cbed3cd10bea61a373e

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

96.252.116.33:80

110.145.11.73:80

185.201.9.197:8080

64.207.182.168:8080

51.89.36.180:443

208.74.26.234:80

89.216.122.92:80

190.164.104.62:80

62.75.141.82:80

94.230.70.6:80

37.187.72.193:8080

72.186.136.247:443

138.68.87.218:443

120.150.60.189:80

24.69.65.8:8080

110.142.236.207:80

74.208.45.104:8080

113.61.66.94:80

74.128.121.17:80

110.145.101.66:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet Payload 5 IoCs

Detects Emotet payload in memory.

trojan banker

Processes:

resource	yara_rule
behavioral11/memory/912-55-0x00000000001C0000-0x00000000001D2000-memory.dmp	emotet
behavioral11/memory/912-59-0x0000000000270000-0x0000000000280000-memory.dmp	emotet
behavioral11/memory/912-62-0x00000000001B0000-0x00000000001BF000-memory.dmp	emotet
behavioral11/memory/1208-66-0x00000000003C0000-0x00000000003D2000-memory.dmp	emotet
behavioral11/memory/1208-70-0x00000000003E0000-0x00000000003F0000-memory.dmp	emotet

Executes dropped EXE 1 IoCs

Processes:

QSVRMGMT.exe

pid process

1208 QSVRMGMT.exe

Drops file in System32 directory 1 IoCs

Processes:

428ff553b67cd782e6d0227ae09c83ba8074fa11cf4bfd91703b2043aa5f6c50.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\iscsiwmi\QSVRMGMT.exe	428ff553b67cd782e6d0227ae09c83ba8074fa11cf4bfd91703b2043aa5f6c50.exe

Drops file in Windows directory 2 IoCs

Processes:

428ff553b67cd782e6d0227ae09c83ba8074fa11cf4bfd91703b2043aa5f6c50.exeQSVRMGMT.exe

description	ioc	process
File opened for modification	C:\Windows\notepad.exe	428ff553b67cd782e6d0227ae09c83ba8074fa11cf4bfd91703b2043aa5f6c50.exe
File opened for modification	C:\Windows\notepad.exe	QSVRMGMT.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

QSVRMGMT.exe

pid	process
1208	QSVRMGMT.exe
1208	QSVRMGMT.exe
1208	QSVRMGMT.exe
1208	QSVRMGMT.exe
1208	QSVRMGMT.exe
1208	QSVRMGMT.exe
1208	QSVRMGMT.exe
1208	QSVRMGMT.exe
1208	QSVRMGMT.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

428ff553b67cd782e6d0227ae09c83ba8074fa11cf4bfd91703b2043aa5f6c50.exe

pid process

912 428ff553b67cd782e6d0227ae09c83ba8074fa11cf4bfd91703b2043aa5f6c50.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

428ff553b67cd782e6d0227ae09c83ba8074fa11cf4bfd91703b2043aa5f6c50.exeQSVRMGMT.exe

pid process

912 428ff553b67cd782e6d0227ae09c83ba8074fa11cf4bfd91703b2043aa5f6c50.exe
1208 QSVRMGMT.exe

pid	process
912	428ff553b67cd782e6d0227ae09c83ba8074fa11cf4bfd91703b2043aa5f6c50.exe

pid	process
912	428ff553b67cd782e6d0227ae09c83ba8074fa11cf4bfd91703b2043aa5f6c50.exe
1208	QSVRMGMT.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

428ff553b67cd782e6d0227ae09c83ba8074fa11cf4bfd91703b2043aa5f6c50.exe

description	pid	process	target process
PID 912 wrote to memory of 1208	912	428ff553b67cd782e6d0227ae09c83ba8074fa11cf4bfd91703b2043aa5f6c50.exe	QSVRMGMT.exe
PID 912 wrote to memory of 1208	912	428ff553b67cd782e6d0227ae09c83ba8074fa11cf4bfd91703b2043aa5f6c50.exe	QSVRMGMT.exe
PID 912 wrote to memory of 1208	912	428ff553b67cd782e6d0227ae09c83ba8074fa11cf4bfd91703b2043aa5f6c50.exe	QSVRMGMT.exe
PID 912 wrote to memory of 1208	912	428ff553b67cd782e6d0227ae09c83ba8074fa11cf4bfd91703b2043aa5f6c50.exe	QSVRMGMT.exe

C:\Users\Admin\AppData\Local\Temp\428ff553b67cd782e6d0227ae09c83ba8074fa11cf4bfd91703b2043aa5f6c50.exe
"C:\Users\Admin\AppData\Local\Temp\428ff553b67cd782e6d0227ae09c83ba8074fa11cf4bfd91703b2043aa5f6c50.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912

C:\Windows\SysWOW64\iscsiwmi\QSVRMGMT.exe
"C:\Windows\SysWOW64\iscsiwmi\QSVRMGMT.exe"
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1208

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\iscsiwmi\QSVRMGMT.exe
Filesize
342KB

MD5
f4853c12c2e213979b03701b36e18960

SHA1
925203dea145358e1457bca76de0edcae8b33961

SHA256
428ff553b67cd782e6d0227ae09c83ba8074fa11cf4bfd91703b2043aa5f6c50

SHA512
2c450e424f88ed9c3e37c03c2f4cc8153392b70320ec5533d17a5e10400c70ec668f8526ea3125364ce7d9eba7dc16295d0587e93c979cbed3cd10bea61a373e

Download Submit
memory/912-54-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/912-55-0x00000000001C0000-0x00000000001D2000-memory.dmp

Filesize
72KB

Download
memory/912-59-0x0000000000270000-0x0000000000280000-memory.dmp

Filesize
64KB

Download
memory/912-62-0x00000000001B0000-0x00000000001BF000-memory.dmp

Filesize
60KB

Download
memory/1208-63-0x0000000000000000-mapping.dmp

Download
memory/1208-66-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1208-70-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download