emotet | 65463c411a1b15fdb4c339d4359ebd59921d0067cd463c8a33bed3948e85dc08

General

Target

65463c411a1b15fdb4c339d4359ebd59921d0067cd463c8a33bed3948e85dc08.exe
Size

369KB
MD5

f7f49deb2b8bc30637628fa4a7917e61
SHA1

f341330f3e3ba6d33ed73c9033d4c616e75a4ffc
SHA256

65463c411a1b15fdb4c339d4359ebd59921d0067cd463c8a33bed3948e85dc08
SHA512

f4c93c8a1451650dfbdb1905ade2aefa5b59d8783bb736652d888d120f8b4d4c6af1879b08bd2ae59b8fc5e3c8b55a29c59d11e21c4781b9dac2d893f72da6ab

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

186.90.29.228:443

181.135.153.203:443

74.208.68.48:8080

104.131.58.132:8080

68.183.190.199:8080

46.28.111.142:7080

186.0.95.172:80

46.41.151.103:8080

190.230.60.129:80

181.188.149.134:80

88.250.223.190:8080

183.82.97.25:80

212.71.237.140:8080

200.57.102.71:8443

189.166.68.89:443

170.84.133.72:7080

81.169.140.14:443

149.62.173.247:8080

94.183.71.206:7080

142.93.82.57:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

rusiell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rusiell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

rusiell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rusiell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C8CA086F-D50D-45A1-AB36-5AD6EAF5BC43}\WpadDecisionReason = "1"	rusiell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C8CA086F-D50D-45A1-AB36-5AD6EAF5BC43}\12-2c-18-70-08-fd	rusiell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C8CA086F-D50D-45A1-AB36-5AD6EAF5BC43}\WpadDecisionTime = e03c74cea89fd801	rusiell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C8CA086F-D50D-45A1-AB36-5AD6EAF5BC43}\WpadNetworkName = "Network 3"	rusiell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-2c-18-70-08-fd\WpadDecision = "0"	rusiell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	rusiell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	rusiell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00e9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rusiell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C8CA086F-D50D-45A1-AB36-5AD6EAF5BC43}	rusiell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-2c-18-70-08-fd\WpadDecisionReason = "1"	rusiell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	rusiell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rusiell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C8CA086F-D50D-45A1-AB36-5AD6EAF5BC43}\WpadDecision = "0"	rusiell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-2c-18-70-08-fd	rusiell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	rusiell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\12-2c-18-70-08-fd\WpadDecisionTime = e03c74cea89fd801	rusiell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	rusiell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rusiell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	rusiell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rusiell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

rusiell.exe

pid process

2032 rusiell.exe
2032 rusiell.exe
2032 rusiell.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

65463c411a1b15fdb4c339d4359ebd59921d0067cd463c8a33bed3948e85dc08.exe

pid process

1920 65463c411a1b15fdb4c339d4359ebd59921d0067cd463c8a33bed3948e85dc08.exe

pid	process
2032	rusiell.exe
2032	rusiell.exe
2032	rusiell.exe

pid	process
1920	65463c411a1b15fdb4c339d4359ebd59921d0067cd463c8a33bed3948e85dc08.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

65463c411a1b15fdb4c339d4359ebd59921d0067cd463c8a33bed3948e85dc08.exe65463c411a1b15fdb4c339d4359ebd59921d0067cd463c8a33bed3948e85dc08.exerusiell.exerusiell.exe

pid	process
972	65463c411a1b15fdb4c339d4359ebd59921d0067cd463c8a33bed3948e85dc08.exe
972	65463c411a1b15fdb4c339d4359ebd59921d0067cd463c8a33bed3948e85dc08.exe
1920	65463c411a1b15fdb4c339d4359ebd59921d0067cd463c8a33bed3948e85dc08.exe
1920	65463c411a1b15fdb4c339d4359ebd59921d0067cd463c8a33bed3948e85dc08.exe
2004	rusiell.exe
2004	rusiell.exe
2032	rusiell.exe
2032	rusiell.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

65463c411a1b15fdb4c339d4359ebd59921d0067cd463c8a33bed3948e85dc08.exerusiell.exe

description	pid	process	target process
PID 972 wrote to memory of 1920	972	65463c411a1b15fdb4c339d4359ebd59921d0067cd463c8a33bed3948e85dc08.exe	65463c411a1b15fdb4c339d4359ebd59921d0067cd463c8a33bed3948e85dc08.exe
PID 972 wrote to memory of 1920	972	65463c411a1b15fdb4c339d4359ebd59921d0067cd463c8a33bed3948e85dc08.exe	65463c411a1b15fdb4c339d4359ebd59921d0067cd463c8a33bed3948e85dc08.exe
PID 972 wrote to memory of 1920	972	65463c411a1b15fdb4c339d4359ebd59921d0067cd463c8a33bed3948e85dc08.exe	65463c411a1b15fdb4c339d4359ebd59921d0067cd463c8a33bed3948e85dc08.exe
PID 972 wrote to memory of 1920	972	65463c411a1b15fdb4c339d4359ebd59921d0067cd463c8a33bed3948e85dc08.exe	65463c411a1b15fdb4c339d4359ebd59921d0067cd463c8a33bed3948e85dc08.exe
PID 2004 wrote to memory of 2032	2004	rusiell.exe	rusiell.exe
PID 2004 wrote to memory of 2032	2004	rusiell.exe	rusiell.exe
PID 2004 wrote to memory of 2032	2004	rusiell.exe	rusiell.exe
PID 2004 wrote to memory of 2032	2004	rusiell.exe	rusiell.exe

C:\Users\Admin\AppData\Local\Temp\65463c411a1b15fdb4c339d4359ebd59921d0067cd463c8a33bed3948e85dc08.exe
"C:\Users\Admin\AppData\Local\Temp\65463c411a1b15fdb4c339d4359ebd59921d0067cd463c8a33bed3948e85dc08.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:972

C:\Users\Admin\AppData\Local\Temp\65463c411a1b15fdb4c339d4359ebd59921d0067cd463c8a33bed3948e85dc08.exe
--6f86ca48
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1920

C:\Windows\SysWOW64\rusiell.exe
"C:\Windows\SysWOW64\rusiell.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\rusiell.exe
--10a48ea2
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2032

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/972-54-0x0000000075D21000-0x0000000075D23000-memory.dmp

Filesize
8KB

Download
memory/972-55-0x0000000000230000-0x0000000000246000-memory.dmp

Filesize
88KB

Download
memory/972-61-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1920-60-0x0000000000000000-mapping.dmp

Download
memory/1920-63-0x00000000002C0000-0x00000000002D6000-memory.dmp

Filesize
88KB

Download
memory/2004-69-0x0000000000250000-0x0000000000266000-memory.dmp

Filesize
88KB

Download
memory/2032-74-0x0000000000000000-mapping.dmp

Download
memory/2032-76-0x00000000003E0000-0x00000000003F6000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads