emotet | a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82

General

Target

a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
Size

524KB
MD5

143d2e2e29d56aa5706c4e7f64e26541
SHA1

3d939f114679f7f9a05375f34648fd51d567f77f
SHA256

a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82
SHA512

36e024c2370732105976484f330d3d61316e58f913b120f870da39cb3faae204a8894d64c7c542dc0cc870dc83984d7b9e128d4ee72a93aa94f53ddd9f8cd094

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

187.188.166.192:80

200.57.102.71:8443

200.21.90.6:8080

46.41.134.46:8080

178.249.187.151:8080

217.199.160.224:8080

71.244.60.230:7080

119.59.124.163:8080

181.36.42.205:443

114.79.134.129:443

62.75.143.100:7080

190.221.50.210:8080

201.184.65.229:80

79.143.182.254:8080

189.187.141.15:50000

190.1.37.125:443

189.129.4.186:80

46.41.151.103:8080

185.86.148.222:8080

46.163.144.228:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

programshell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	programshell.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exea22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exeprogramshell.exeprogramshell.exe

description	pid	process	target process
PID 900 set thread context of 1088	900	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 948 set thread context of 2020	948	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 1980 set thread context of 1492	1980	programshell.exe	programshell.exe
PID 656 set thread context of 1320	656	programshell.exe	programshell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

programshell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	programshell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{90D956C4-B25B-4C53-B2CD-E42F97A0A996}\WpadNetworkName = "Network 3"	programshell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{90D956C4-B25B-4C53-B2CD-E42F97A0A996}\42-1d-8c-03-f4-c2	programshell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-1d-8c-03-f4-c2\WpadDecisionTime = 4053b4adbda4d801	programshell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	programshell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	programshell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	programshell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	programshell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	programshell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00e8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	programshell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-1d-8c-03-f4-c2\WpadDecision = "0"	programshell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	programshell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	programshell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{90D956C4-B25B-4C53-B2CD-E42F97A0A996}	programshell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{90D956C4-B25B-4C53-B2CD-E42F97A0A996}\WpadDecisionReason = "1"	programshell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{90D956C4-B25B-4C53-B2CD-E42F97A0A996}\WpadDecision = "0"	programshell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-1d-8c-03-f4-c2\WpadDecisionReason = "1"	programshell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	programshell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	programshell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{90D956C4-B25B-4C53-B2CD-E42F97A0A996}\WpadDecisionTime = 4053b4adbda4d801	programshell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-1d-8c-03-f4-c2	programshell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

programshell.exe

pid process

1320 programshell.exe
1320 programshell.exe
1320 programshell.exe

pid	process
1320	programshell.exe
1320	programshell.exe
1320	programshell.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exea22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exeprogramshell.exeprogramshell.exe

pid	process
900	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
948	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
1980	programshell.exe
656	programshell.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe

pid process

2020 a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe

pid	process
2020	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exea22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exeprogramshell.exeprogramshell.exe

pid	process
900	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
948	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
1980	programshell.exe
656	programshell.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exea22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exea22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exeprogramshell.exeprogramshell.exeprogramshell.exe

description	pid	process	target process
PID 900 wrote to memory of 1088	900	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 900 wrote to memory of 1088	900	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 900 wrote to memory of 1088	900	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 900 wrote to memory of 1088	900	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 900 wrote to memory of 1088	900	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 1088 wrote to memory of 948	1088	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 1088 wrote to memory of 948	1088	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 1088 wrote to memory of 948	1088	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 1088 wrote to memory of 948	1088	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 948 wrote to memory of 2020	948	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 948 wrote to memory of 2020	948	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 948 wrote to memory of 2020	948	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 948 wrote to memory of 2020	948	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 948 wrote to memory of 2020	948	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 1980 wrote to memory of 1492	1980	programshell.exe	programshell.exe
PID 1980 wrote to memory of 1492	1980	programshell.exe	programshell.exe
PID 1980 wrote to memory of 1492	1980	programshell.exe	programshell.exe
PID 1980 wrote to memory of 1492	1980	programshell.exe	programshell.exe
PID 1980 wrote to memory of 1492	1980	programshell.exe	programshell.exe
PID 1492 wrote to memory of 656	1492	programshell.exe	programshell.exe
PID 1492 wrote to memory of 656	1492	programshell.exe	programshell.exe
PID 1492 wrote to memory of 656	1492	programshell.exe	programshell.exe
PID 1492 wrote to memory of 656	1492	programshell.exe	programshell.exe
PID 656 wrote to memory of 1320	656	programshell.exe	programshell.exe
PID 656 wrote to memory of 1320	656	programshell.exe	programshell.exe
PID 656 wrote to memory of 1320	656	programshell.exe	programshell.exe
PID 656 wrote to memory of 1320	656	programshell.exe	programshell.exe
PID 656 wrote to memory of 1320	656	programshell.exe	programshell.exe

C:\Users\Admin\AppData\Local\Temp\a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
"C:\Users\Admin\AppData\Local\Temp\a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:900

C:\Users\Admin\AppData\Local\Temp\a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
"C:\Users\Admin\AppData\Local\Temp\a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1088

C:\Users\Admin\AppData\Local\Temp\a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
--d72bc9da
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948

C:\Users\Admin\AppData\Local\Temp\a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
--d72bc9da
4⤵
- Suspicious behavior: RenamesItself
PID:2020

C:\Windows\SysWOW64\programshell.exe
"C:\Windows\SysWOW64\programshell.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\programshell.exe
"C:\Windows\SysWOW64\programshell.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1492

C:\Windows\SysWOW64\programshell.exe
--20303c7e
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:656

C:\Windows\SysWOW64\programshell.exe
--20303c7e
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1320

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/656-74-0x0000000000000000-mapping.dmp

Download
memory/656-77-0x0000000000A50000-0x0000000000A64000-memory.dmp

Filesize
80KB

Download
memory/900-55-0x0000000000280000-0x0000000000294000-memory.dmp

Filesize
80KB

Download
memory/900-60-0x0000000000250000-0x0000000000263000-memory.dmp

Filesize
76KB

Download
memory/900-54-0x00000000754C1000-0x00000000754C3000-memory.dmp

Filesize
8KB

Download
memory/948-59-0x0000000000000000-mapping.dmp

Download
memory/1088-61-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1088-58-0x000000000040D977-mapping.dmp

Download
memory/1320-80-0x000000000040D977-mapping.dmp

Download
memory/1320-81-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1320-83-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1492-73-0x000000000040D977-mapping.dmp

Download
memory/1980-70-0x0000000000610000-0x0000000000624000-memory.dmp

Filesize
80KB

Download
memory/2020-66-0x000000000040D977-mapping.dmp

Download
memory/2020-67-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2020-75-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads