emotet | 7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be

General

Target

7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
Size

166KB
MD5

692b5738f923a8b6ed55f3ad76daf5d4
SHA1

4c57090c7d3f8507ab88cee0720d44caa4550ec8
SHA256

7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be
SHA512

d48cb39b382f6a4423f80a4a7cb23e0af93259ecaeabc3a388c24ed9687121aaae82319dc757d66eaee182c846006471809e85830afc9dbad70e5cd13c1efdfa

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

181.99.235.57:80

187.199.158.226:443

186.0.95.172:80

46.41.134.46:8080

178.249.187.151:8080

217.199.160.224:8080

71.244.60.230:7080

119.59.124.163:8080

109.169.86.13:8080

190.200.64.180:7080

217.113.27.158:443

71.244.60.231:7080

46.21.105.59:8080

179.62.18.56:443

211.229.116.97:80

88.250.223.190:8080

181.188.149.134:80

91.205.215.57:7080

190.230.60.129:80

77.55.211.77:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

lumberbased.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	lumberbased.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	lumberbased.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	lumberbased.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	lumberbased.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exelumberbased.exelumberbased.exe

description	pid	process	target process
PID 3732 set thread context of 3284	3732	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 4944 set thread context of 3812	4944	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 856 set thread context of 4756	856	lumberbased.exe	lumberbased.exe
PID 4708 set thread context of 3636	4708	lumberbased.exe	lumberbased.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

lumberbased.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	lumberbased.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	lumberbased.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	lumberbased.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

lumberbased.exe

pid	process
3636	lumberbased.exe
3636	lumberbased.exe
3636	lumberbased.exe
3636	lumberbased.exe
3636	lumberbased.exe
3636	lumberbased.exe
3636	lumberbased.exe
3636	lumberbased.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exelumberbased.exelumberbased.exe

pid	process
3732	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
4944	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
856	lumberbased.exe
4708	lumberbased.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe

pid process

3812 7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe

pid	process
3812	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exelumberbased.exelumberbased.exelumberbased.exe

description	pid	process	target process
PID 3732 wrote to memory of 3284	3732	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 3732 wrote to memory of 3284	3732	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 3732 wrote to memory of 3284	3732	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 3732 wrote to memory of 3284	3732	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 3284 wrote to memory of 4944	3284	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 3284 wrote to memory of 4944	3284	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 3284 wrote to memory of 4944	3284	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 4944 wrote to memory of 3812	4944	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 4944 wrote to memory of 3812	4944	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 4944 wrote to memory of 3812	4944	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 4944 wrote to memory of 3812	4944	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe	7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
PID 856 wrote to memory of 4756	856	lumberbased.exe	lumberbased.exe
PID 856 wrote to memory of 4756	856	lumberbased.exe	lumberbased.exe
PID 856 wrote to memory of 4756	856	lumberbased.exe	lumberbased.exe
PID 856 wrote to memory of 4756	856	lumberbased.exe	lumberbased.exe
PID 4756 wrote to memory of 4708	4756	lumberbased.exe	lumberbased.exe
PID 4756 wrote to memory of 4708	4756	lumberbased.exe	lumberbased.exe
PID 4756 wrote to memory of 4708	4756	lumberbased.exe	lumberbased.exe
PID 4708 wrote to memory of 3636	4708	lumberbased.exe	lumberbased.exe
PID 4708 wrote to memory of 3636	4708	lumberbased.exe	lumberbased.exe
PID 4708 wrote to memory of 3636	4708	lumberbased.exe	lumberbased.exe
PID 4708 wrote to memory of 3636	4708	lumberbased.exe	lumberbased.exe

C:\Users\Admin\AppData\Local\Temp\7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
"C:\Users\Admin\AppData\Local\Temp\7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3732

C:\Users\Admin\AppData\Local\Temp\7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
"C:\Users\Admin\AppData\Local\Temp\7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3284

C:\Users\Admin\AppData\Local\Temp\7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
--3f43da6e
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4944

C:\Users\Admin\AppData\Local\Temp\7b19d210d01ac6cccebd6e472f71f775c8f2daf2418017d4cbe96fc70529c0be.exe
--3f43da6e
4⤵
- Suspicious behavior: RenamesItself
PID:3812

C:\Windows\SysWOW64\lumberbased.exe
"C:\Windows\SysWOW64\lumberbased.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:856

C:\Windows\SysWOW64\lumberbased.exe
"C:\Windows\SysWOW64\lumberbased.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4756

C:\Windows\SysWOW64\lumberbased.exe
--ba67ad5e
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4708

C:\Windows\SysWOW64\lumberbased.exe
--ba67ad5e
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3636

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/856-142-0x0000000000DB0000-0x0000000000DC4000-memory.dmp

Filesize
80KB

Download
memory/3284-136-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3284-134-0x0000000000000000-mapping.dmp

Download
memory/3636-151-0x0000000000000000-mapping.dmp

Download
memory/3636-153-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3636-152-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3732-130-0x0000000000A60000-0x0000000000A74000-memory.dmp

Filesize
80KB

Download
memory/3732-133-0x0000000000A40000-0x0000000000A59000-memory.dmp

Filesize
100KB

Download
memory/3812-140-0x0000000000000000-mapping.dmp

Download
memory/3812-141-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3812-147-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4708-146-0x0000000000000000-mapping.dmp

Download
memory/4708-148-0x0000000000DA0000-0x0000000000DB4000-memory.dmp

Filesize
80KB

Download
memory/4756-145-0x0000000000000000-mapping.dmp

Download
memory/4944-137-0x0000000000920000-0x0000000000934000-memory.dmp

Filesize
80KB

Download
memory/4944-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads