emotet | 7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be

General

Target

7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
Size

166KB
MD5

692b5738f923a8b6ed55f3ad76daf5d4
SHA1

4c57090c7d3f8507ab88cee0720d44caa4550ec8
SHA256

7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be
SHA512

d48cb39b382f6a4423f80a4a7cb23e0af93259ecaeabc3a388c24ed9687121aaae82319dc757d66eaee182c846006471809e85830afc9dbad70e5cd13c1efdfa

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

181.99.235.57:80

187.199.158.226:443

186.0.95.172:80

46.41.134.46:8080

178.249.187.151:8080

217.199.160.224:8080

71.244.60.230:7080

119.59.124.163:8080

109.169.86.13:8080

190.200.64.180:7080

217.113.27.158:443

71.244.60.231:7080

46.21.105.59:8080

179.62.18.56:443

211.229.116.97:80

88.250.223.190:8080

181.188.149.134:80

91.205.215.57:7080

190.230.60.129:80

77.55.211.77:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

countershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	countershell.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.execountershell.execountershell.exe

description	pid	process	target process
PID 1760 set thread context of 820	1760	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 2020 set thread context of 1140	2020	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 1964 set thread context of 636	1964	countershell.exe	countershell.exe
PID 1116 set thread context of 1328	1116	countershell.exe	countershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

countershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	countershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	countershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	countershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FB3BA126-FD83-479D-B737-6BB85B0C2856}\WpadDecisionTime = 4022cd3e3aa0d801	countershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FB3BA126-FD83-479D-B737-6BB85B0C2856}\WpadDecision = "0"	countershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	countershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-07-c5-c5-06-77\WpadDecisionTime = 4022cd3e3aa0d801	countershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FB3BA126-FD83-479D-B737-6BB85B0C2856}\WpadDecisionReason = "1"	countershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-07-c5-c5-06-77	countershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FB3BA126-FD83-479D-B737-6BB85B0C2856}\9a-07-c5-c5-06-77	countershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	countershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	countershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	countershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	countershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	countershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-07-c5-c5-06-77\WpadDecision = "0"	countershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	countershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	countershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FB3BA126-FD83-479D-B737-6BB85B0C2856}	countershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FB3BA126-FD83-479D-B737-6BB85B0C2856}\WpadNetworkName = "Network 3"	countershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-07-c5-c5-06-77\WpadDecisionReason = "1"	countershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

countershell.exe

pid process

1328 countershell.exe
1328 countershell.exe

pid	process
1328	countershell.exe
1328	countershell.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.execountershell.execountershell.exe

pid	process
1760	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
2020	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
1964	countershell.exe
1116	countershell.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe

pid process

1140 7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe

pid	process
1140	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.execountershell.execountershell.execountershell.exe

description	pid	process	target process
PID 1760 wrote to memory of 820	1760	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 1760 wrote to memory of 820	1760	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 1760 wrote to memory of 820	1760	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 1760 wrote to memory of 820	1760	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 1760 wrote to memory of 820	1760	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 820 wrote to memory of 2020	820	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 820 wrote to memory of 2020	820	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 820 wrote to memory of 2020	820	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 820 wrote to memory of 2020	820	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 2020 wrote to memory of 1140	2020	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 2020 wrote to memory of 1140	2020	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 2020 wrote to memory of 1140	2020	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 2020 wrote to memory of 1140	2020	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 2020 wrote to memory of 1140	2020	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 1964 wrote to memory of 636	1964	countershell.exe	countershell.exe
PID 1964 wrote to memory of 636	1964	countershell.exe	countershell.exe
PID 1964 wrote to memory of 636	1964	countershell.exe	countershell.exe
PID 1964 wrote to memory of 636	1964	countershell.exe	countershell.exe
PID 1964 wrote to memory of 636	1964	countershell.exe	countershell.exe
PID 636 wrote to memory of 1116	636	countershell.exe	countershell.exe
PID 636 wrote to memory of 1116	636	countershell.exe	countershell.exe
PID 636 wrote to memory of 1116	636	countershell.exe	countershell.exe
PID 636 wrote to memory of 1116	636	countershell.exe	countershell.exe
PID 1116 wrote to memory of 1328	1116	countershell.exe	countershell.exe
PID 1116 wrote to memory of 1328	1116	countershell.exe	countershell.exe
PID 1116 wrote to memory of 1328	1116	countershell.exe	countershell.exe
PID 1116 wrote to memory of 1328	1116	countershell.exe	countershell.exe
PID 1116 wrote to memory of 1328	1116	countershell.exe	countershell.exe

C:\Users\Admin\AppData\Local\Temp\7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
"C:\Users\Admin\AppData\Local\Temp\7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1760

C:\Users\Admin\AppData\Local\Temp\7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
"C:\Users\Admin\AppData\Local\Temp\7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:820

C:\Users\Admin\AppData\Local\Temp\7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
--3f43da6e
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2020

C:\Users\Admin\AppData\Local\Temp\7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
--3f43da6e
4⤵
- Suspicious behavior: RenamesItself
PID:1140

C:\Windows\SysWOW64\countershell.exe
"C:\Windows\SysWOW64\countershell.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\countershell.exe
"C:\Windows\SysWOW64\countershell.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:636

C:\Windows\SysWOW64\countershell.exe
--6e851b86
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\SysWOW64\countershell.exe
--6e851b86
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1328

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/636-74-0x000000000040D977-mapping.dmp

Download
memory/820-61-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/820-59-0x000000000040D977-mapping.dmp

Download
memory/1116-78-0x00000000003E0000-0x00000000003F4000-memory.dmp

Filesize
80KB

Download
memory/1116-75-0x0000000000000000-mapping.dmp

Download
memory/1140-67-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1140-66-0x000000000040D977-mapping.dmp

Download
memory/1140-69-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1140-76-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1328-81-0x000000000040D977-mapping.dmp

Download
memory/1328-82-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1328-84-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1760-54-0x0000000075301000-0x0000000075303000-memory.dmp

Filesize
8KB

Download
memory/1760-58-0x0000000000450000-0x0000000000469000-memory.dmp

Filesize
100KB

Download
memory/1760-55-0x0000000000470000-0x0000000000484000-memory.dmp

Filesize
80KB

Download
memory/1964-71-0x00000000007A0000-0x00000000007B4000-memory.dmp

Filesize
80KB

Download
memory/2020-63-0x00000000002A0000-0x00000000002B4000-memory.dmp

Filesize
80KB

Download
memory/2020-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads