emotet | f84bff87f9060e2b3503779befa6179a3534c98e2c65ea26e16f2459a3ea5f8b

General

Target

f84bff87f9060e2b3503779befa6179a3534c98e2c65ea26e16f2459a3ea5f8b.exe
Size

299KB
MD5

ab764825c4ec1cb0bdc256431b0a3421
SHA1

cd085882032929c7896b3004c51acba5ff8c04bf
SHA256

f84bff87f9060e2b3503779befa6179a3534c98e2c65ea26e16f2459a3ea5f8b
SHA512

562972c163ed3b6b981237b607367d6fd14172e1aac589f48ab8b3a167e8540d04a266e55cf421f9fe616ab7d24c82009d962608f317bb2c3093efb6dd20a432

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

186.90.29.228:443

181.135.153.203:443

74.208.68.48:8080

104.131.58.132:8080

68.183.190.199:8080

50.28.51.143:8080

77.55.211.77:8080

181.29.101.13:8080

178.79.163.131:8080

5.1.86.195:8080

187.188.166.192:80

203.25.159.3:8080

139.5.237.27:443

190.1.37.125:443

200.58.171.51:80

186.1.41.111:443

46.29.183.211:8080

109.169.86.13:8080

71.244.60.231:7080

159.203.204.126:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

pinkpink.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	pinkpink.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

pinkpink.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	pinkpink.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	pinkpink.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7CCF5307-5422-4941-B888-5ED6BB40BD6C}\WpadDecisionTime = 00426737dca4d801	pinkpink.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7CCF5307-5422-4941-B888-5ED6BB40BD6C}\6e-55-88-35-6c-71	pinkpink.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	pinkpink.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	pinkpink.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	pinkpink.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	pinkpink.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\6e-55-88-35-6c-71\WpadDecision = "0"	pinkpink.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\6e-55-88-35-6c-71\WpadDecisionReason = "1"	pinkpink.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	pinkpink.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	pinkpink.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7CCF5307-5422-4941-B888-5ED6BB40BD6C}\WpadDecisionReason = "1"	pinkpink.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7CCF5307-5422-4941-B888-5ED6BB40BD6C}\WpadNetworkName = "Network 3"	pinkpink.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	pinkpink.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	pinkpink.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00f7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	pinkpink.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7CCF5307-5422-4941-B888-5ED6BB40BD6C}\WpadDecision = "0"	pinkpink.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7CCF5307-5422-4941-B888-5ED6BB40BD6C}	pinkpink.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\6e-55-88-35-6c-71	pinkpink.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\6e-55-88-35-6c-71\WpadDecisionTime = 00426737dca4d801	pinkpink.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

pinkpink.exe

pid process

1944 pinkpink.exe
1944 pinkpink.exe
1944 pinkpink.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

f84bff87f9060e2b3503779befa6179a3534c98e2c65ea26e16f2459a3ea5f8b.exe

pid process

1984 f84bff87f9060e2b3503779befa6179a3534c98e2c65ea26e16f2459a3ea5f8b.exe

pid	process
1944	pinkpink.exe
1944	pinkpink.exe
1944	pinkpink.exe

pid	process
1984	f84bff87f9060e2b3503779befa6179a3534c98e2c65ea26e16f2459a3ea5f8b.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

f84bff87f9060e2b3503779befa6179a3534c98e2c65ea26e16f2459a3ea5f8b.exepinkpink.exe

description	pid	process	target process
PID 1684 wrote to memory of 1984	1684	f84bff87f9060e2b3503779befa6179a3534c98e2c65ea26e16f2459a3ea5f8b.exe	f84bff87f9060e2b3503779befa6179a3534c98e2c65ea26e16f2459a3ea5f8b.exe
PID 1684 wrote to memory of 1984	1684	f84bff87f9060e2b3503779befa6179a3534c98e2c65ea26e16f2459a3ea5f8b.exe	f84bff87f9060e2b3503779befa6179a3534c98e2c65ea26e16f2459a3ea5f8b.exe
PID 1684 wrote to memory of 1984	1684	f84bff87f9060e2b3503779befa6179a3534c98e2c65ea26e16f2459a3ea5f8b.exe	f84bff87f9060e2b3503779befa6179a3534c98e2c65ea26e16f2459a3ea5f8b.exe
PID 1684 wrote to memory of 1984	1684	f84bff87f9060e2b3503779befa6179a3534c98e2c65ea26e16f2459a3ea5f8b.exe	f84bff87f9060e2b3503779befa6179a3534c98e2c65ea26e16f2459a3ea5f8b.exe
PID 1052 wrote to memory of 1944	1052	pinkpink.exe	pinkpink.exe
PID 1052 wrote to memory of 1944	1052	pinkpink.exe	pinkpink.exe
PID 1052 wrote to memory of 1944	1052	pinkpink.exe	pinkpink.exe
PID 1052 wrote to memory of 1944	1052	pinkpink.exe	pinkpink.exe

C:\Users\Admin\AppData\Local\Temp\f84bff87f9060e2b3503779befa6179a3534c98e2c65ea26e16f2459a3ea5f8b.exe
"C:\Users\Admin\AppData\Local\Temp\f84bff87f9060e2b3503779befa6179a3534c98e2c65ea26e16f2459a3ea5f8b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Users\Admin\AppData\Local\Temp\f84bff87f9060e2b3503779befa6179a3534c98e2c65ea26e16f2459a3ea5f8b.exe
--a742f094
2⤵
- Suspicious behavior: RenamesItself
PID:1984

C:\Windows\SysWOW64\pinkpink.exe
"C:\Windows\SysWOW64\pinkpink.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1052

C:\Windows\SysWOW64\pinkpink.exe
--bff045fe
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1944

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1052-69-0x00000000003B0000-0x00000000003C7000-memory.dmp

Filesize
92KB

Download
memory/1684-54-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download
memory/1684-55-0x00000000003C0000-0x00000000003D7000-memory.dmp

Filesize
92KB

Download
memory/1684-61-0x00000000003B0000-0x00000000003C0000-memory.dmp

Filesize
64KB

Download
memory/1944-74-0x0000000000000000-mapping.dmp

Download
memory/1944-76-0x0000000000390000-0x00000000003A7000-memory.dmp

Filesize
92KB

Download
memory/1984-60-0x0000000000000000-mapping.dmp

Download
memory/1984-63-0x0000000000230000-0x0000000000247000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads