emotet | ad1e15f62f123ff2753ec2912a8edd4569aff3919a63fe07446d1765020d242c

General

Target

sample.exe
Size

440KB
MD5

8b57ab47e811305e03ba1f557a3a6d50
SHA1

cf5281d61b8375d71122c1eb21d82e1a4446a12e
SHA256

6bcfbca95b078ee669f6b18141a68be27f8c2fd4dc13696cff4f45d3d2671d66
SHA512

d8595b93bfc126b9f7166c156893c87ea6e6c06b66667edd5e5bef2aeee55c4ce6a4a3e825ce218341890e4a7f922e678c693a7d6b32e1ac56ab6d33f892de07

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

70.175.171.251:80

173.70.81.77:80

107.2.2.28:80

108.179.206.219:8080

59.110.18.236:443

45.56.88.91:443

206.81.10.215:8080

176.31.200.130:8080

200.71.148.138:8080

211.63.71.72:8080

190.108.228.48:990

186.75.241.230:80

104.236.246.93:8080

45.33.49.124:443

91.205.215.66:8080

107.170.24.125:8080

190.226.44.20:21

104.131.11.150:8080

93.147.141.5:80

213.179.105.214:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

rdsrds.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	rdsrds.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	rdsrds.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	rdsrds.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	rdsrds.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

rdsrds.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	rdsrds.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rdsrds.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	rdsrds.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rdsrds.exe

pid process

4420 rdsrds.exe
4420 rdsrds.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

sample.exe

pid process

224 sample.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

sample.exesample.exerdsrds.exerdsrds.exe

pid process

4116 sample.exe
224 sample.exe
4664 rdsrds.exe
4420 rdsrds.exe

pid	process
4420	rdsrds.exe
4420	rdsrds.exe

pid	process
224	sample.exe

pid	process
4116	sample.exe
224	sample.exe
4664	rdsrds.exe
4420	rdsrds.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

sample.exerdsrds.exe

description	pid	process	target process
PID 4116 wrote to memory of 224	4116	sample.exe	sample.exe
PID 4116 wrote to memory of 224	4116	sample.exe	sample.exe
PID 4116 wrote to memory of 224	4116	sample.exe	sample.exe
PID 4664 wrote to memory of 4420	4664	rdsrds.exe	rdsrds.exe
PID 4664 wrote to memory of 4420	4664	rdsrds.exe	rdsrds.exe
PID 4664 wrote to memory of 4420	4664	rdsrds.exe	rdsrds.exe

C:\Users\Admin\AppData\Local\Temp\sample.exe
"C:\Users\Admin\AppData\Local\Temp\sample.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116

C:\Users\Admin\AppData\Local\Temp\sample.exe
--ecf24aae
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:224

C:\Windows\SysWOW64\rdsrds.exe
"C:\Windows\SysWOW64\rdsrds.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4664

C:\Windows\SysWOW64\rdsrds.exe
--c93bd9d2
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4420

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\8ffb9018b2e109743be184ff16b6778e_20e30e2f-4677-4eb9-89e6-7dd1fd044635
Filesize
50B

MD5
7c04b741ed0174e4ba5c29806d83ee9f

SHA1
04861b99c159fdf10229a5c61cb84b706bf2c8e4

SHA256
c96e59212c5fa746b2dc44610c90c289545be44cdf7cc58c5cab9f87d6202e16

SHA512
67799203d184c5df6bb0d2ba5620a7b174267cbe8f38ee17e8fd906ac79877948a4e467dc63c5bd3f5ca965afef88ee0abb6623a61e13a775d6d65b998ce26ff

Download Submit
memory/224-135-0x0000000000000000-mapping.dmp

Download
memory/224-138-0x0000000000750000-0x0000000000767000-memory.dmp

Filesize
92KB

Download
memory/4116-130-0x00000000023E0000-0x00000000023F7000-memory.dmp

Filesize
92KB

Download
memory/4116-136-0x00000000022B0000-0x00000000022C1000-memory.dmp

Filesize
68KB

Download
memory/4420-147-0x0000000000000000-mapping.dmp

Download
memory/4420-149-0x0000000000E20000-0x0000000000E37000-memory.dmp

Filesize
92KB

Download
memory/4664-142-0x0000000000DB0000-0x0000000000DC7000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads