emotet | 4e5257f3269d45a08e9aebc15fbc27c0de9c5b5481008b2158f164b1c6d0d697

General

Target

4e5257f3269d45a08e9aebc15fbc27c0de9c5b5481008b2158f164b1c6d0d697.exe
Size

607KB
MD5

781a26507093dd6c3f2e38e6864fc502
SHA1

33e84acc42351abfabd8481d4c53a48412400e4e
SHA256

4e5257f3269d45a08e9aebc15fbc27c0de9c5b5481008b2158f164b1c6d0d697
SHA512

d0e707e62175e0ca3557262d517e84e1401646448c67f94c2039c51ed2128cc2393f70348c5f30a63c4c46d7857dbea1524c4071579f162a40aa1aca207b12ff

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

186.90.29.228:443

181.135.153.203:443

74.208.68.48:8080

104.131.58.132:8080

68.183.190.199:8080

50.28.51.143:8080

77.55.211.77:8080

181.29.101.13:8080

178.79.163.131:8080

5.1.86.195:8080

187.188.166.192:80

203.25.159.3:8080

139.5.237.27:443

190.1.37.125:443

200.58.171.51:80

186.1.41.111:443

46.29.183.211:8080

109.169.86.13:8080

71.244.60.231:7080

159.203.204.126:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

cplsproc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	cplsproc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

cplsproc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	cplsproc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D0511350-1C34-4538-BC7B-FD0BB9A4D0C6}\WpadDecisionReason = "1"	cplsproc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D0511350-1C34-4538-BC7B-FD0BB9A4D0C6}\WpadDecisionTime = 9094f3a7879cd801	cplsproc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-64-39-7c-a4-f5\WpadDecisionTime = 9094f3a7879cd801	cplsproc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-64-39-7c-a4-f5\WpadDecision = "0"	cplsproc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	cplsproc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	cplsproc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	cplsproc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	cplsproc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00b9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	cplsproc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D0511350-1C34-4538-BC7B-FD0BB9A4D0C6}\c6-64-39-7c-a4-f5	cplsproc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	cplsproc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	cplsproc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	cplsproc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D0511350-1C34-4538-BC7B-FD0BB9A4D0C6}\WpadDecision = "0"	cplsproc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	cplsproc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	cplsproc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D0511350-1C34-4538-BC7B-FD0BB9A4D0C6}	cplsproc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D0511350-1C34-4538-BC7B-FD0BB9A4D0C6}\WpadNetworkName = "Network 3"	cplsproc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-64-39-7c-a4-f5	cplsproc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-64-39-7c-a4-f5\WpadDecisionReason = "1"	cplsproc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

cplsproc.exe

pid process

836 cplsproc.exe
836 cplsproc.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

4e5257f3269d45a08e9aebc15fbc27c0de9c5b5481008b2158f164b1c6d0d697.exe

pid process

1468 4e5257f3269d45a08e9aebc15fbc27c0de9c5b5481008b2158f164b1c6d0d697.exe

pid	process
836	cplsproc.exe
836	cplsproc.exe

pid	process
1468	4e5257f3269d45a08e9aebc15fbc27c0de9c5b5481008b2158f164b1c6d0d697.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

4e5257f3269d45a08e9aebc15fbc27c0de9c5b5481008b2158f164b1c6d0d697.exe4e5257f3269d45a08e9aebc15fbc27c0de9c5b5481008b2158f164b1c6d0d697.execplsproc.execplsproc.exe

pid	process
1308	4e5257f3269d45a08e9aebc15fbc27c0de9c5b5481008b2158f164b1c6d0d697.exe
1468	4e5257f3269d45a08e9aebc15fbc27c0de9c5b5481008b2158f164b1c6d0d697.exe
2020	cplsproc.exe
836	cplsproc.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

4e5257f3269d45a08e9aebc15fbc27c0de9c5b5481008b2158f164b1c6d0d697.execplsproc.exe

description	pid	process	target process
PID 1308 wrote to memory of 1468	1308	4e5257f3269d45a08e9aebc15fbc27c0de9c5b5481008b2158f164b1c6d0d697.exe	4e5257f3269d45a08e9aebc15fbc27c0de9c5b5481008b2158f164b1c6d0d697.exe
PID 1308 wrote to memory of 1468	1308	4e5257f3269d45a08e9aebc15fbc27c0de9c5b5481008b2158f164b1c6d0d697.exe	4e5257f3269d45a08e9aebc15fbc27c0de9c5b5481008b2158f164b1c6d0d697.exe
PID 1308 wrote to memory of 1468	1308	4e5257f3269d45a08e9aebc15fbc27c0de9c5b5481008b2158f164b1c6d0d697.exe	4e5257f3269d45a08e9aebc15fbc27c0de9c5b5481008b2158f164b1c6d0d697.exe
PID 1308 wrote to memory of 1468	1308	4e5257f3269d45a08e9aebc15fbc27c0de9c5b5481008b2158f164b1c6d0d697.exe	4e5257f3269d45a08e9aebc15fbc27c0de9c5b5481008b2158f164b1c6d0d697.exe
PID 2020 wrote to memory of 836	2020	cplsproc.exe	cplsproc.exe
PID 2020 wrote to memory of 836	2020	cplsproc.exe	cplsproc.exe
PID 2020 wrote to memory of 836	2020	cplsproc.exe	cplsproc.exe
PID 2020 wrote to memory of 836	2020	cplsproc.exe	cplsproc.exe

C:\Users\Admin\AppData\Local\Temp\4e5257f3269d45a08e9aebc15fbc27c0de9c5b5481008b2158f164b1c6d0d697.exe
"C:\Users\Admin\AppData\Local\Temp\4e5257f3269d45a08e9aebc15fbc27c0de9c5b5481008b2158f164b1c6d0d697.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308

C:\Users\Admin\AppData\Local\Temp\4e5257f3269d45a08e9aebc15fbc27c0de9c5b5481008b2158f164b1c6d0d697.exe
--680385a7
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1468

C:\Windows\SysWOW64\cplsproc.exe
"C:\Windows\SysWOW64\cplsproc.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\cplsproc.exe
--9823a81c
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/836-74-0x0000000000000000-mapping.dmp

Download
memory/836-76-0x00000000001C0000-0x00000000001D7000-memory.dmp

Filesize
92KB

Download
memory/1308-54-0x00000000763E1000-0x00000000763E3000-memory.dmp

Filesize
8KB

Download
memory/1308-55-0x00000000003C0000-0x00000000003D7000-memory.dmp

Filesize
92KB

Download
memory/1308-61-0x00000000001B0000-0x00000000001C0000-memory.dmp

Filesize
64KB

Download
memory/1468-60-0x0000000000000000-mapping.dmp

Download
memory/1468-63-0x0000000000230000-0x0000000000247000-memory.dmp

Filesize
92KB

Download
memory/2020-69-0x0000000000300000-0x0000000000317000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads