emotet | a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82

General

Target

a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
Size

524KB
MD5

143d2e2e29d56aa5706c4e7f64e26541
SHA1

3d939f114679f7f9a05375f34648fd51d567f77f
SHA256

a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82
SHA512

36e024c2370732105976484f330d3d61316e58f913b120f870da39cb3faae204a8894d64c7c542dc0cc870dc83984d7b9e128d4ee72a93aa94f53ddd9f8cd094

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

187.188.166.192:80

200.57.102.71:8443

200.21.90.6:8080

46.41.134.46:8080

178.249.187.151:8080

217.199.160.224:8080

71.244.60.230:7080

119.59.124.163:8080

181.36.42.205:443

114.79.134.129:443

62.75.143.100:7080

190.221.50.210:8080

201.184.65.229:80

79.143.182.254:8080

189.187.141.15:50000

190.1.37.125:443

189.129.4.186:80

46.41.151.103:8080

185.86.148.222:8080

46.163.144.228:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

nlsdlchunk.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	nlsdlchunk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	nlsdlchunk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	nlsdlchunk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	nlsdlchunk.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exea22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exenlsdlchunk.exenlsdlchunk.exe

description	pid	process	target process
PID 2992 set thread context of 4216	2992	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 4168 set thread context of 1996	4168	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 1208 set thread context of 2160	1208	nlsdlchunk.exe	nlsdlchunk.exe
PID 4920 set thread context of 4760	4920	nlsdlchunk.exe	nlsdlchunk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

nlsdlchunk.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	nlsdlchunk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	nlsdlchunk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	nlsdlchunk.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

nlsdlchunk.exe

pid	process
4760	nlsdlchunk.exe
4760	nlsdlchunk.exe
4760	nlsdlchunk.exe
4760	nlsdlchunk.exe
4760	nlsdlchunk.exe
4760	nlsdlchunk.exe
4760	nlsdlchunk.exe
4760	nlsdlchunk.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exea22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exenlsdlchunk.exenlsdlchunk.exe

pid	process
2992	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
4168	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
1208	nlsdlchunk.exe
4920	nlsdlchunk.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe

pid process

1996 a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe

pid	process
1996	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exea22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exenlsdlchunk.exenlsdlchunk.exe

pid	process
2992	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
4168	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
1208	nlsdlchunk.exe
4920	nlsdlchunk.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exea22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exea22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exenlsdlchunk.exenlsdlchunk.exenlsdlchunk.exe

description	pid	process	target process
PID 2992 wrote to memory of 4216	2992	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 2992 wrote to memory of 4216	2992	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 2992 wrote to memory of 4216	2992	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 2992 wrote to memory of 4216	2992	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 4216 wrote to memory of 4168	4216	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 4216 wrote to memory of 4168	4216	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 4216 wrote to memory of 4168	4216	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 4168 wrote to memory of 1996	4168	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 4168 wrote to memory of 1996	4168	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 4168 wrote to memory of 1996	4168	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 4168 wrote to memory of 1996	4168	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe	a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
PID 1208 wrote to memory of 2160	1208	nlsdlchunk.exe	nlsdlchunk.exe
PID 1208 wrote to memory of 2160	1208	nlsdlchunk.exe	nlsdlchunk.exe
PID 1208 wrote to memory of 2160	1208	nlsdlchunk.exe	nlsdlchunk.exe
PID 1208 wrote to memory of 2160	1208	nlsdlchunk.exe	nlsdlchunk.exe
PID 2160 wrote to memory of 4920	2160	nlsdlchunk.exe	nlsdlchunk.exe
PID 2160 wrote to memory of 4920	2160	nlsdlchunk.exe	nlsdlchunk.exe
PID 2160 wrote to memory of 4920	2160	nlsdlchunk.exe	nlsdlchunk.exe
PID 4920 wrote to memory of 4760	4920	nlsdlchunk.exe	nlsdlchunk.exe
PID 4920 wrote to memory of 4760	4920	nlsdlchunk.exe	nlsdlchunk.exe
PID 4920 wrote to memory of 4760	4920	nlsdlchunk.exe	nlsdlchunk.exe
PID 4920 wrote to memory of 4760	4920	nlsdlchunk.exe	nlsdlchunk.exe

C:\Users\Admin\AppData\Local\Temp\a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
"C:\Users\Admin\AppData\Local\Temp\a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992

C:\Users\Admin\AppData\Local\Temp\a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
"C:\Users\Admin\AppData\Local\Temp\a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4216

C:\Users\Admin\AppData\Local\Temp\a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
--d72bc9da
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4168

C:\Users\Admin\AppData\Local\Temp\a22732be1da7ae878bdc01f7e2431030c616a071a56d5324f1771ef942a57e82.exe
--d72bc9da
4⤵
- Suspicious behavior: RenamesItself
PID:1996

C:\Windows\SysWOW64\nlsdlchunk.exe
"C:\Windows\SysWOW64\nlsdlchunk.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\SysWOW64\nlsdlchunk.exe
"C:\Windows\SysWOW64\nlsdlchunk.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2160

C:\Windows\SysWOW64\nlsdlchunk.exe
--b69570c2
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920

C:\Windows\SysWOW64\nlsdlchunk.exe
--b69570c2
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4760

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-143-0x0000000000E30000-0x0000000000E44000-memory.dmp

Filesize
80KB

Download
memory/1996-148-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1996-142-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1996-140-0x0000000000000000-mapping.dmp

Download
memory/1996-141-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2160-146-0x0000000000000000-mapping.dmp

Download
memory/2992-130-0x00000000022B0000-0x00000000022C4000-memory.dmp

Filesize
80KB

Download
memory/2992-135-0x0000000002290000-0x00000000022A3000-memory.dmp

Filesize
76KB

Download
memory/4168-134-0x0000000000000000-mapping.dmp

Download
memory/4168-137-0x0000000002090000-0x00000000020A4000-memory.dmp

Filesize
80KB

Download
memory/4216-133-0x0000000000000000-mapping.dmp

Download
memory/4216-136-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4760-152-0x0000000000000000-mapping.dmp

Download
memory/4760-153-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4760-154-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4920-147-0x0000000000000000-mapping.dmp

Download
memory/4920-149-0x0000000000620000-0x0000000000634000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads