emotet | 6fa0dd6002d4b4e7ebabefc7f4f90f36fc53069e0cf4e845f683fb087d476e90

General

Target

0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Size

490KB
MD5

f4d1470af3a7d82560b38558b132d468
SHA1

0c45cf4e32116eae8d73b52c140f5d91a19ee8ea
SHA256

6fa0dd6002d4b4e7ebabefc7f4f90f36fc53069e0cf4e845f683fb087d476e90
SHA512

1f45093e1509d86ab03ee2c6f15a6dbc3ed4f41cac3c8faf5ae66445b787b58bf9e69d047d7ead3d1d22284d351fbb739a7a7eb73180f746f3d4f621859206c8
SSDEEP

12288:x1n6BAlECcMIR4WlptZ2uOIR4bi6/Myw52BLhDG5Fq:x16SbcMMlpLLOS

Score

10^/10

emotet epoch3 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

190.117.206.153:443

203.99.187.137:443

200.55.168.82:20

70.32.94.58:8080

213.138.100.98:8080

144.76.62.10:8080

203.99.188.203:990

201.196.15.79:990

203.99.182.135:443

176.58.93.123:80

192.241.220.183:8080

94.177.253.126:80

181.47.235.26:993

216.75.37.196:8080

95.216.207.86:7080

78.109.34.178:443

113.52.135.33:7080

216.70.88.55:8080

138.197.140.163:8080

181.113.229.139:990

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

pinksizes.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	pinksizes.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	pinksizes.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	pinksizes.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	pinksizes.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

pinksizes.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	pinksizes.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	pinksizes.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	pinksizes.exe

Modifies registry class 64 IoCs

Processes:

0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exepinksizes.exepinksizes.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]"	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew\NullFile	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\ = "Recalc Document"	pinksizes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command	pinksizes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL	pinksizes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command	pinksizes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0C45CF~1.EXE,0"	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command	pinksizes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\ = "Recalc Document"	pinksizes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]"	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec\ = "[open(\"%1\")]"	pinksizes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ = "Recalc.Document.1"	pinksizes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0C45CF~1.EXE /dde"	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command	pinksizes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command\ = "C:\\Windows\\SysWOW64\\PINKSI~1.EXE /dde"	pinksizes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew\NullFile	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	pinksizes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command	pinksizes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\ = "Recalc Document"	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	pinksizes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command\ = "C:\\Windows\\SysWOW64\\PINKSI~1.EXE /dde"	pinksizes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0C45CF~1.EXE /dde"	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]"	pinksizes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec	pinksizes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec\ = "[open(\"%1\")]"	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec\ = "[open(\"%1\")]"	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0C45CF~1.EXE /dde"	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command\ = "C:\\Windows\\SysWOW64\\PINKSI~1.EXE /dde"	pinksizes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew	pinksizes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1	pinksizes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon\ = "C:\\Windows\\SysWOW64\\PINKSI~1.EXE,0"	pinksizes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew	pinksizes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\ = "Recalc Document"	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0C45CF~1.EXE /dde"	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec\ = "[open(\"%1\")]"	pinksizes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec	pinksizes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command\ = "C:\\Windows\\SysWOW64\\PINKSI~1.EXE /dde"	pinksizes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command	pinksizes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec	pinksizes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]"	pinksizes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ = "Recalc.Document.1"	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command\ = "C:\\Windows\\SysWOW64\\PINKSI~1.EXE /dde"	pinksizes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL	pinksizes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

pinksizes.exe

pid	process
2008	pinksizes.exe
2008	pinksizes.exe
2008	pinksizes.exe
2008	pinksizes.exe
2008	pinksizes.exe
2008	pinksizes.exe
2008	pinksizes.exe
2008	pinksizes.exe
2008	pinksizes.exe
2008	pinksizes.exe
2008	pinksizes.exe
2008	pinksizes.exe
2008	pinksizes.exe
2008	pinksizes.exe
2008	pinksizes.exe
2008	pinksizes.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe

pid process

4856 0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe

pid	process
4856	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exepinksizes.exepinksizes.exe

pid	process
4972	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
4972	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
4856	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
4856	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
228	pinksizes.exe
228	pinksizes.exe
2008	pinksizes.exe
2008	pinksizes.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exepinksizes.exe

description	pid	process	target process
PID 4972 wrote to memory of 4856	4972	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
PID 4972 wrote to memory of 4856	4972	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
PID 4972 wrote to memory of 4856	4972	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe	0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
PID 228 wrote to memory of 2008	228	pinksizes.exe	pinksizes.exe
PID 228 wrote to memory of 2008	228	pinksizes.exe	pinksizes.exe
PID 228 wrote to memory of 2008	228	pinksizes.exe	pinksizes.exe

C:\Users\Admin\AppData\Local\Temp\0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
"C:\Users\Admin\AppData\Local\Temp\0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972

C:\Users\Admin\AppData\Local\Temp\0c45cf4e32116eae8d73b52c140f5d91a19ee8ea.exe
--b91fe435
2⤵
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:4856

C:\Windows\SysWOW64\pinksizes.exe
"C:\Windows\SysWOW64\pinksizes.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:228

C:\Windows\SysWOW64\pinksizes.exe
--c6dbfad2
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2008

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/228-144-0x0000000000E50000-0x0000000000E66000-memory.dmp

Filesize
88KB

Download
memory/2008-149-0x0000000000000000-mapping.dmp

Download
memory/2008-150-0x0000000000E40000-0x0000000000E56000-memory.dmp

Filesize
88KB

Download
memory/4856-137-0x0000000000000000-mapping.dmp

Download
memory/4856-138-0x00000000021D0000-0x00000000021E6000-memory.dmp

Filesize
88KB

Download
memory/4972-132-0x0000000002300000-0x0000000002316000-memory.dmp

Filesize
88KB

Download
memory/4972-143-0x00000000022E0000-0x00000000022F0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads