emotet | ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96

General

Target

ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe
Size

216KB
MD5

23d5ae6d628d21faf98e8f29c7f91b1a
SHA1

7dbf772a085b093c7cfed6c79b26a21b85fc9a77
SHA256

ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96
SHA512

4c72ccc0d7c83588be4e65e7475879ea3459818da5e9fbedbe4c866031460d715057ed48299538ea6c470318eaa00c1f9adcb676f1f711a30309067ecd0b1fe5

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

190.117.206.153:443

179.62.18.56:443

123.168.4.66:22

178.249.187.151:8080

217.199.160.224:8080

62.75.150.240:7080

71.244.60.230:7080

119.59.124.163:8080

211.229.116.97:80

190.38.14.52:80

217.113.27.158:443

203.25.159.3:8080

190.19.42.131:80

187.188.166.192:80

51.15.8.192:8080

23.92.22.225:7080

189.166.68.89:443

88.250.223.190:8080

189.129.4.186:80

86.42.166.147:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

iconsmove.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	iconsmove.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	iconsmove.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	iconsmove.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	iconsmove.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exeea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exeiconsmove.exeiconsmove.exe

description	pid	process	target process
PID 2168 set thread context of 2200	2168	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe
PID 2612 set thread context of 892	2612	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe
PID 5016 set thread context of 4596	5016	iconsmove.exe	iconsmove.exe
PID 5040 set thread context of 752	5040	iconsmove.exe	iconsmove.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

iconsmove.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	iconsmove.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	iconsmove.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	iconsmove.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

iconsmove.exe

pid	process
752	iconsmove.exe
752	iconsmove.exe
752	iconsmove.exe
752	iconsmove.exe
752	iconsmove.exe
752	iconsmove.exe
752	iconsmove.exe
752	iconsmove.exe
752	iconsmove.exe
752	iconsmove.exe
752	iconsmove.exe
752	iconsmove.exe
752	iconsmove.exe
752	iconsmove.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exeea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exeiconsmove.exeiconsmove.exe

pid	process
2168	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe
2612	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe
5016	iconsmove.exe
5040	iconsmove.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe

pid process

892 ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe

pid	process
892	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exeea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exeea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exeiconsmove.exeiconsmove.exeiconsmove.exe

description	pid	process	target process
PID 2168 wrote to memory of 2200	2168	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe
PID 2168 wrote to memory of 2200	2168	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe
PID 2168 wrote to memory of 2200	2168	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe
PID 2168 wrote to memory of 2200	2168	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe
PID 2200 wrote to memory of 2612	2200	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe
PID 2200 wrote to memory of 2612	2200	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe
PID 2200 wrote to memory of 2612	2200	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe
PID 2612 wrote to memory of 892	2612	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe
PID 2612 wrote to memory of 892	2612	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe
PID 2612 wrote to memory of 892	2612	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe
PID 2612 wrote to memory of 892	2612	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe	ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe
PID 5016 wrote to memory of 4596	5016	iconsmove.exe	iconsmove.exe
PID 5016 wrote to memory of 4596	5016	iconsmove.exe	iconsmove.exe
PID 5016 wrote to memory of 4596	5016	iconsmove.exe	iconsmove.exe
PID 5016 wrote to memory of 4596	5016	iconsmove.exe	iconsmove.exe
PID 4596 wrote to memory of 5040	4596	iconsmove.exe	iconsmove.exe
PID 4596 wrote to memory of 5040	4596	iconsmove.exe	iconsmove.exe
PID 4596 wrote to memory of 5040	4596	iconsmove.exe	iconsmove.exe
PID 5040 wrote to memory of 752	5040	iconsmove.exe	iconsmove.exe
PID 5040 wrote to memory of 752	5040	iconsmove.exe	iconsmove.exe
PID 5040 wrote to memory of 752	5040	iconsmove.exe	iconsmove.exe
PID 5040 wrote to memory of 752	5040	iconsmove.exe	iconsmove.exe

C:\Users\Admin\AppData\Local\Temp\ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe
"C:\Users\Admin\AppData\Local\Temp\ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2168

C:\Users\Admin\AppData\Local\Temp\ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe
"C:\Users\Admin\AppData\Local\Temp\ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2200

C:\Users\Admin\AppData\Local\Temp\ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe
--f9d8f465
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2612

C:\Users\Admin\AppData\Local\Temp\ea3ab5487723762843ddf79db9d5aaf83c4159bf1e7eb9b884159a4867384f96.exe
--f9d8f465
4⤵
- Suspicious behavior: RenamesItself
PID:892

C:\Windows\SysWOW64\iconsmove.exe
"C:\Windows\SysWOW64\iconsmove.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5016

C:\Windows\SysWOW64\iconsmove.exe
"C:\Windows\SysWOW64\iconsmove.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4596

C:\Windows\SysWOW64\iconsmove.exe
--758e9e21
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5040

C:\Windows\SysWOW64\iconsmove.exe
--758e9e21
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:752

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-156-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/752-155-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/752-153-0x0000000000000000-mapping.dmp

Download
memory/892-143-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/892-154-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/892-144-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/892-142-0x0000000000000000-mapping.dmp

Download
memory/2168-138-0x00000000005A0000-0x00000000005B3000-memory.dmp

Filesize
76KB

Download
memory/2168-132-0x00000000005C0000-0x00000000005D4000-memory.dmp

Filesize
80KB

Download
memory/2200-137-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2200-135-0x0000000000000000-mapping.dmp

Download
memory/2612-139-0x0000000000960000-0x0000000000974000-memory.dmp

Filesize
80KB

Download
memory/2612-136-0x0000000000000000-mapping.dmp

Download
memory/4596-148-0x0000000000000000-mapping.dmp

Download
memory/5016-145-0x00000000009C0000-0x00000000009D4000-memory.dmp

Filesize
80KB

Download
memory/5040-149-0x0000000000000000-mapping.dmp

Download
memory/5040-150-0x00000000005F0000-0x0000000000604000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads