emotet | d43d298aaa1e0d3c77c7deaf09f5b38431455d9ddde5bc8ad86fe7e7433bce2e

General

Target

d43d298aaa1e0d3c77c7deaf09f5b38431455d9ddde5bc8ad86fe7e7433bce2e.exe
Size

365KB
MD5

c4d31cf47fd14301bb53f5520e15e951
SHA1

7e557a0bc95d461d2f765424850b8e575aa3b88e
SHA256

d43d298aaa1e0d3c77c7deaf09f5b38431455d9ddde5bc8ad86fe7e7433bce2e
SHA512

9bef8fff5a9a0405919052687a92d10e85914f70b6a8f60991ea9c0cde1465c5474d098540f6554eda4a3343114f497591a993f441a3fd75375a22f45197b0d1

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

86.22.221.170:80

187.144.61.73:443

185.94.252.13:443

46.105.131.87:80

69.164.201.54:8080

190.211.207.11:443

186.4.172.5:8080

167.71.10.37:8080

182.176.132.213:8090

47.41.213.2:22

80.11.163.139:443

186.4.172.5:20

37.157.194.134:443

59.103.164.174:80

136.243.177.26:8080

162.241.208.52:8080

27.4.80.183:443

85.104.59.244:20

212.71.234.16:8080

27.147.163.188:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

mgmipsps.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	mgmipsps.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	mgmipsps.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	mgmipsps.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	mgmipsps.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

mgmipsps.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mgmipsps.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mgmipsps.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mgmipsps.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

mgmipsps.exe

pid	process
4228	mgmipsps.exe
4228	mgmipsps.exe
4228	mgmipsps.exe
4228	mgmipsps.exe
4228	mgmipsps.exe
4228	mgmipsps.exe
4228	mgmipsps.exe
4228	mgmipsps.exe
4228	mgmipsps.exe
4228	mgmipsps.exe
4228	mgmipsps.exe
4228	mgmipsps.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

d43d298aaa1e0d3c77c7deaf09f5b38431455d9ddde5bc8ad86fe7e7433bce2e.exe

pid process

1776 d43d298aaa1e0d3c77c7deaf09f5b38431455d9ddde5bc8ad86fe7e7433bce2e.exe

pid	process
1776	d43d298aaa1e0d3c77c7deaf09f5b38431455d9ddde5bc8ad86fe7e7433bce2e.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

d43d298aaa1e0d3c77c7deaf09f5b38431455d9ddde5bc8ad86fe7e7433bce2e.exed43d298aaa1e0d3c77c7deaf09f5b38431455d9ddde5bc8ad86fe7e7433bce2e.exemgmipsps.exemgmipsps.exe

pid	process
4880	d43d298aaa1e0d3c77c7deaf09f5b38431455d9ddde5bc8ad86fe7e7433bce2e.exe
4880	d43d298aaa1e0d3c77c7deaf09f5b38431455d9ddde5bc8ad86fe7e7433bce2e.exe
1776	d43d298aaa1e0d3c77c7deaf09f5b38431455d9ddde5bc8ad86fe7e7433bce2e.exe
1776	d43d298aaa1e0d3c77c7deaf09f5b38431455d9ddde5bc8ad86fe7e7433bce2e.exe
4136	mgmipsps.exe
4136	mgmipsps.exe
4228	mgmipsps.exe
4228	mgmipsps.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

d43d298aaa1e0d3c77c7deaf09f5b38431455d9ddde5bc8ad86fe7e7433bce2e.exemgmipsps.exe

description	pid	process	target process
PID 4880 wrote to memory of 1776	4880	d43d298aaa1e0d3c77c7deaf09f5b38431455d9ddde5bc8ad86fe7e7433bce2e.exe	d43d298aaa1e0d3c77c7deaf09f5b38431455d9ddde5bc8ad86fe7e7433bce2e.exe
PID 4880 wrote to memory of 1776	4880	d43d298aaa1e0d3c77c7deaf09f5b38431455d9ddde5bc8ad86fe7e7433bce2e.exe	d43d298aaa1e0d3c77c7deaf09f5b38431455d9ddde5bc8ad86fe7e7433bce2e.exe
PID 4880 wrote to memory of 1776	4880	d43d298aaa1e0d3c77c7deaf09f5b38431455d9ddde5bc8ad86fe7e7433bce2e.exe	d43d298aaa1e0d3c77c7deaf09f5b38431455d9ddde5bc8ad86fe7e7433bce2e.exe
PID 4136 wrote to memory of 4228	4136	mgmipsps.exe	mgmipsps.exe
PID 4136 wrote to memory of 4228	4136	mgmipsps.exe	mgmipsps.exe
PID 4136 wrote to memory of 4228	4136	mgmipsps.exe	mgmipsps.exe

C:\Users\Admin\AppData\Local\Temp\d43d298aaa1e0d3c77c7deaf09f5b38431455d9ddde5bc8ad86fe7e7433bce2e.exe
"C:\Users\Admin\AppData\Local\Temp\d43d298aaa1e0d3c77c7deaf09f5b38431455d9ddde5bc8ad86fe7e7433bce2e.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4880

C:\Users\Admin\AppData\Local\Temp\d43d298aaa1e0d3c77c7deaf09f5b38431455d9ddde5bc8ad86fe7e7433bce2e.exe
--b117fbaa
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1776

C:\Windows\SysWOW64\mgmipsps.exe
"C:\Windows\SysWOW64\mgmipsps.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136

C:\Windows\SysWOW64\mgmipsps.exe
--1d4ac00e
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4228

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1776-135-0x0000000000000000-mapping.dmp

Download
memory/1776-136-0x0000000002260000-0x0000000002274000-memory.dmp

Filesize
80KB

Download
memory/4136-143-0x0000000000DF0000-0x0000000000E04000-memory.dmp

Filesize
80KB

Download
memory/4228-147-0x0000000000000000-mapping.dmp

Download
memory/4880-130-0x0000000000680000-0x0000000000694000-memory.dmp

Filesize
80KB

Download
memory/4880-141-0x0000000000650000-0x000000000065F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads