emotet | 91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a

General

Target

91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
Size

388KB
MD5

284fe79685a92ad19d607e5466c5d810
SHA1

87b2ca3abc4e11754a6ffcefc233095f9cda9da6
SHA256

91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a
SHA512

99cf27f6f66d603d00da6fbc9b7c33fbb620a495c2558d1e3c131987214c8cc82dc9867faceee0d6fa2d84064d59446cf7a92d88ac88e11fa8c73630f1381277

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

105.186.87.144:80

186.75.241.230:80

200.21.90.6:80

212.129.24.82:8080

162.144.47.94:7080

77.237.248.136:8080

185.142.236.163:443

63.142.253.122:8080

190.145.67.134:8090

182.176.132.213:8090

88.247.163.44:80

85.106.1.166:50000

45.123.3.54:443

37.157.194.134:443

142.44.162.209:8080

159.65.25.128:8080

190.211.207.11:443

85.104.59.244:20

201.251.43.69:8080

101.187.237.217:20

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

windowrstrt.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	windowrstrt.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exewindowrstrt.exewindowrstrt.exe

description	pid	process	target process
PID 1320 set thread context of 624	1320	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 956 set thread context of 816	956	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 1772 set thread context of 1616	1772	windowrstrt.exe	windowrstrt.exe
PID 1992 set thread context of 520	1992	windowrstrt.exe	windowrstrt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

windowrstrt.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	windowrstrt.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	windowrstrt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	windowrstrt.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE0DBFFB-8459-4FD7-877A-F578FC5B79ED}\WpadDecisionTime = 3099321b188dd801	windowrstrt.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	windowrstrt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE0DBFFB-8459-4FD7-877A-F578FC5B79ED}\0a-43-2e-98-cc-c4	windowrstrt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-43-2e-98-cc-c4\WpadDecisionReason = "1"	windowrstrt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	windowrstrt.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f008e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	windowrstrt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE0DBFFB-8459-4FD7-877A-F578FC5B79ED}	windowrstrt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE0DBFFB-8459-4FD7-877A-F578FC5B79ED}\WpadDecisionReason = "1"	windowrstrt.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE0DBFFB-8459-4FD7-877A-F578FC5B79ED}\WpadNetworkName = "Network 3"	windowrstrt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-43-2e-98-cc-c4	windowrstrt.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	windowrstrt.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	windowrstrt.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	windowrstrt.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	windowrstrt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	windowrstrt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DE0DBFFB-8459-4FD7-877A-F578FC5B79ED}\WpadDecision = "0"	windowrstrt.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-43-2e-98-cc-c4\WpadDecisionTime = 3099321b188dd801	windowrstrt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-43-2e-98-cc-c4\WpadDecision = "0"	windowrstrt.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

windowrstrt.exe

pid process

520 windowrstrt.exe
520 windowrstrt.exe
520 windowrstrt.exe

pid	process
520	windowrstrt.exe
520	windowrstrt.exe
520	windowrstrt.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exewindowrstrt.exewindowrstrt.exe

pid	process
1320	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
956	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
1772	windowrstrt.exe
1992	windowrstrt.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe

pid process

816 91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe

pid	process
816	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exewindowrstrt.exewindowrstrt.exe

pid	process
1320	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
956	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
1772	windowrstrt.exe
1992	windowrstrt.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exewindowrstrt.exewindowrstrt.exewindowrstrt.exe

description	pid	process	target process
PID 1320 wrote to memory of 624	1320	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 1320 wrote to memory of 624	1320	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 1320 wrote to memory of 624	1320	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 1320 wrote to memory of 624	1320	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 1320 wrote to memory of 624	1320	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 624 wrote to memory of 956	624	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 624 wrote to memory of 956	624	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 624 wrote to memory of 956	624	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 624 wrote to memory of 956	624	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 956 wrote to memory of 816	956	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 956 wrote to memory of 816	956	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 956 wrote to memory of 816	956	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 956 wrote to memory of 816	956	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 956 wrote to memory of 816	956	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 1772 wrote to memory of 1616	1772	windowrstrt.exe	windowrstrt.exe
PID 1772 wrote to memory of 1616	1772	windowrstrt.exe	windowrstrt.exe
PID 1772 wrote to memory of 1616	1772	windowrstrt.exe	windowrstrt.exe
PID 1772 wrote to memory of 1616	1772	windowrstrt.exe	windowrstrt.exe
PID 1772 wrote to memory of 1616	1772	windowrstrt.exe	windowrstrt.exe
PID 1616 wrote to memory of 1992	1616	windowrstrt.exe	windowrstrt.exe
PID 1616 wrote to memory of 1992	1616	windowrstrt.exe	windowrstrt.exe
PID 1616 wrote to memory of 1992	1616	windowrstrt.exe	windowrstrt.exe
PID 1616 wrote to memory of 1992	1616	windowrstrt.exe	windowrstrt.exe
PID 1992 wrote to memory of 520	1992	windowrstrt.exe	windowrstrt.exe
PID 1992 wrote to memory of 520	1992	windowrstrt.exe	windowrstrt.exe
PID 1992 wrote to memory of 520	1992	windowrstrt.exe	windowrstrt.exe
PID 1992 wrote to memory of 520	1992	windowrstrt.exe	windowrstrt.exe
PID 1992 wrote to memory of 520	1992	windowrstrt.exe	windowrstrt.exe

C:\Users\Admin\AppData\Local\Temp\91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
"C:\Users\Admin\AppData\Local\Temp\91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320

C:\Users\Admin\AppData\Local\Temp\91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
"C:\Users\Admin\AppData\Local\Temp\91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:624

C:\Users\Admin\AppData\Local\Temp\91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
--461c794b
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956

C:\Users\Admin\AppData\Local\Temp\91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
--461c794b
4⤵
- Suspicious behavior: RenamesItself
PID:816

C:\Windows\SysWOW64\windowrstrt.exe
"C:\Windows\SysWOW64\windowrstrt.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1772

C:\Windows\SysWOW64\windowrstrt.exe
"C:\Windows\SysWOW64\windowrstrt.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\SysWOW64\windowrstrt.exe
--126fb2fb
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\windowrstrt.exe
--126fb2fb
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:520

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/520-80-0x000000000040F072-mapping.dmp

Download
memory/520-83-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/520-81-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/624-58-0x000000000040F072-mapping.dmp

Download
memory/624-61-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/816-75-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/816-66-0x000000000040F072-mapping.dmp

Download
memory/816-67-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/956-63-0x00000000002F0000-0x0000000000306000-memory.dmp

Filesize
88KB

Download
memory/956-60-0x0000000000000000-mapping.dmp

Download
memory/1320-54-0x0000000075CD1000-0x0000000075CD3000-memory.dmp

Filesize
8KB

Download
memory/1320-59-0x00000000003C0000-0x00000000003D5000-memory.dmp

Filesize
84KB

Download
memory/1320-55-0x00000000003E0000-0x00000000003F6000-memory.dmp

Filesize
88KB

Download
memory/1616-73-0x000000000040F072-mapping.dmp

Download
memory/1772-70-0x0000000000A50000-0x0000000000A66000-memory.dmp

Filesize
88KB

Download
memory/1992-74-0x0000000000000000-mapping.dmp

Download
memory/1992-77-0x00000000008C0000-0x00000000008D6000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads