emotet | 91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a

General

Target

91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
Size

388KB
MD5

284fe79685a92ad19d607e5466c5d810
SHA1

87b2ca3abc4e11754a6ffcefc233095f9cda9da6
SHA256

91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a
SHA512

99cf27f6f66d603d00da6fbc9b7c33fbb620a495c2558d1e3c131987214c8cc82dc9867faceee0d6fa2d84064d59446cf7a92d88ac88e11fa8c73630f1381277

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

105.186.87.144:80

186.75.241.230:80

200.21.90.6:80

212.129.24.82:8080

162.144.47.94:7080

77.237.248.136:8080

185.142.236.163:443

63.142.253.122:8080

190.145.67.134:8090

182.176.132.213:8090

88.247.163.44:80

85.106.1.166:50000

45.123.3.54:443

37.157.194.134:443

142.44.162.209:8080

159.65.25.128:8080

190.211.207.11:443

85.104.59.244:20

201.251.43.69:8080

101.187.237.217:20

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

reporttlb.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	reporttlb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	reporttlb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	reporttlb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	reporttlb.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exereporttlb.exereporttlb.exe

description	pid	process	target process
PID 2664 set thread context of 2536	2664	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 3480 set thread context of 1460	3480	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 2776 set thread context of 2896	2776	reporttlb.exe	reporttlb.exe
PID 2120 set thread context of 5080	2120	reporttlb.exe	reporttlb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

reporttlb.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	reporttlb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	reporttlb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	reporttlb.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

reporttlb.exe

pid	process
5080	reporttlb.exe
5080	reporttlb.exe
5080	reporttlb.exe
5080	reporttlb.exe
5080	reporttlb.exe
5080	reporttlb.exe
5080	reporttlb.exe
5080	reporttlb.exe
5080	reporttlb.exe
5080	reporttlb.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exereporttlb.exereporttlb.exe

pid	process
2664	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
3480	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
2776	reporttlb.exe
2120	reporttlb.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe

pid process

1460 91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe

pid	process
1460	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exereporttlb.exereporttlb.exe

pid	process
2664	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
3480	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
2776	reporttlb.exe
2120	reporttlb.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exereporttlb.exereporttlb.exereporttlb.exe

description	pid	process	target process
PID 2664 wrote to memory of 2536	2664	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 2664 wrote to memory of 2536	2664	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 2664 wrote to memory of 2536	2664	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 2664 wrote to memory of 2536	2664	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 2536 wrote to memory of 3480	2536	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 2536 wrote to memory of 3480	2536	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 2536 wrote to memory of 3480	2536	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 3480 wrote to memory of 1460	3480	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 3480 wrote to memory of 1460	3480	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 3480 wrote to memory of 1460	3480	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 3480 wrote to memory of 1460	3480	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe	91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
PID 2776 wrote to memory of 2896	2776	reporttlb.exe	reporttlb.exe
PID 2776 wrote to memory of 2896	2776	reporttlb.exe	reporttlb.exe
PID 2776 wrote to memory of 2896	2776	reporttlb.exe	reporttlb.exe
PID 2776 wrote to memory of 2896	2776	reporttlb.exe	reporttlb.exe
PID 2896 wrote to memory of 2120	2896	reporttlb.exe	reporttlb.exe
PID 2896 wrote to memory of 2120	2896	reporttlb.exe	reporttlb.exe
PID 2896 wrote to memory of 2120	2896	reporttlb.exe	reporttlb.exe
PID 2120 wrote to memory of 5080	2120	reporttlb.exe	reporttlb.exe
PID 2120 wrote to memory of 5080	2120	reporttlb.exe	reporttlb.exe
PID 2120 wrote to memory of 5080	2120	reporttlb.exe	reporttlb.exe
PID 2120 wrote to memory of 5080	2120	reporttlb.exe	reporttlb.exe

C:\Users\Admin\AppData\Local\Temp\91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
"C:\Users\Admin\AppData\Local\Temp\91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664

C:\Users\Admin\AppData\Local\Temp\91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
"C:\Users\Admin\AppData\Local\Temp\91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2536

C:\Users\Admin\AppData\Local\Temp\91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
--461c794b
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3480

C:\Users\Admin\AppData\Local\Temp\91f29c8521aef0e261ff28bc4824380791d63d28cf6525cdef6858157dcc210a.exe
--461c794b
4⤵
- Suspicious behavior: RenamesItself
PID:1460

C:\Windows\SysWOW64\reporttlb.exe
"C:\Windows\SysWOW64\reporttlb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776

C:\Windows\SysWOW64\reporttlb.exe
"C:\Windows\SysWOW64\reporttlb.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2896

C:\Windows\SysWOW64\reporttlb.exe
--3635ac
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120

C:\Windows\SysWOW64\reporttlb.exe
--3635ac
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5080

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1460-140-0x0000000000000000-mapping.dmp

Download
memory/1460-147-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1460-141-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2120-148-0x0000000000E20000-0x0000000000E36000-memory.dmp

Filesize
88KB

Download
memory/2120-146-0x0000000000000000-mapping.dmp

Download
memory/2536-136-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2536-133-0x0000000000000000-mapping.dmp

Download
memory/2664-130-0x00000000022D0000-0x00000000022E6000-memory.dmp

Filesize
88KB

Download
memory/2664-134-0x00000000022B0000-0x00000000022C5000-memory.dmp

Filesize
84KB

Download
memory/2776-142-0x0000000000610000-0x0000000000626000-memory.dmp

Filesize
88KB

Download
memory/2896-145-0x0000000000000000-mapping.dmp

Download
memory/3480-137-0x00000000009E0000-0x00000000009F6000-memory.dmp

Filesize
88KB

Download
memory/3480-135-0x0000000000000000-mapping.dmp

Download
memory/5080-151-0x0000000000000000-mapping.dmp

Download
memory/5080-152-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5080-153-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads