emotet | 09819925fdc296619617875dc4a026ed5657b455c0520c53729430e951e752f2

General

Target
1d703d84368e0c53f6706276da6858bdd7df55e6.exe
Size 276KB
Sample221130-gva6msdb56
SHA256 09819925fdc296619617875dc4a026ed5657b455c0520c53729430e951e752f2
MD5 276d2ef178f1d319a7ab74aee99917bf
SHA1 1d703d84368e0c53f6706276da6858bdd7df55e6
SHA512 cf8d467ad34d4612e3b6319f2b8e81df36adeecdc59b6d9377b850755536e2d713badebddaafac882a38c3481e0c2006ce7ad0054129092f71ce63115fa376ba
SSDEEP 3072:7nuxOYPgjfFO+f5/Tx/udGrNGDxD4O8WfRtaG/70Jfm4JuLYwO9/+Tl:OPgjNl/8kIxD4OdpzcflQu1+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

124.240.198.66:80
186.75.241.230:80
181.143.194.138:443
45.79.188.67:8080
77.237.248.136:8080
185.142.236.163:443
63.142.253.122:8080
178.254.6.27:7080
190.211.207.11:443
78.188.105.159:21
182.176.106.43:995
178.79.161.166:443
206.189.98.125:8080
87.230.19.21:8080
80.11.163.139:443
101.187.237.217:20
190.18.146.70:80
86.98.25.30:53
92.222.125.16:7080
186.4.172.5:443
169.239.182.217:8080
189.209.217.49:80
104.236.246.93:8080
190.228.72.244:53
88.247.163.44:80
45.123.3.54:443
91.205.215.66:8080
190.106.97.230:443
199.19.237.192:80
186.4.172.5:20
94.205.247.10:80
104.131.11.150:8080
144.139.247.220:80
119.15.153.237:80
173.212.203.26:8080
136.243.177.26:8080
5.196.74.210:8080
85.104.59.244:20
190.186.203.55:80
187.144.189.58:50000
78.24.219.147:8080
186.4.172.5:8080
46.105.131.87:80
149.167.86.174:990
222.214.218.192:8080
88.156.97.210:80
185.94.252.13:443
190.226.44.20:21
217.145.83.44:80
80.11.163.139:21
138.201.140.110:8080
190.53.135.159:21
31.172.240.91:8080
92.222.216.44:8080
87.106.139.101:8080
159.65.25.128:8080
31.12.67.62:7080
211.63.71.72:8080
179.32.19.219:22
92.233.128.13:143
87.106.136.232:8080
182.176.132.213:8090
37.157.194.134:443
181.143.53.227:21
188.166.253.46:8080
41.220.119.246:80
95.128.43.213:8080
103.97.95.218:143
201.251.43.69:8080
190.108.228.48:990
149.202.153.252:8080
24.51.106.145:21
182.76.6.2:8080
85.106.1.166:50000
62.75.187.192:8080
142.44.162.209:8080
45.33.49.124:443
27.147.163.188:8080
217.160.182.191:8080
212.71.234.16:8080
83.136.245.190:8080
47.41.213.2:22
103.255.150.84:80
200.71.148.138:8080
190.145.67.134:8090

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	foldersreadand.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	foldersreadand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	foldersreadand.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0032000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	foldersreadand.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCDBC71C-7792-4BBF-9601-BDE99DC579CA}	foldersreadand.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5e-2f-ac-5a-ab-cd	foldersreadand.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCDBC71C-7792-4BBF-9601-BDE99DC579CA}\5e-2f-ac-5a-ab-cd	foldersreadand.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5e-2f-ac-5a-ab-cd\WpadDecision = "0"	foldersreadand.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	foldersreadand.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	foldersreadand.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	foldersreadand.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	foldersreadand.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	foldersreadand.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	foldersreadand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	foldersreadand.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCDBC71C-7792-4BBF-9601-BDE99DC579CA}\WpadDecision = "0"	foldersreadand.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5e-2f-ac-5a-ab-cd\WpadDecisionTime = e02a349d8a04d901	foldersreadand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	foldersreadand.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCDBC71C-7792-4BBF-9601-BDE99DC579CA}\WpadDecisionTime = e02a349d8a04d901	foldersreadand.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5e-2f-ac-5a-ab-cd\WpadDecisionReason = "1"	foldersreadand.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCDBC71C-7792-4BBF-9601-BDE99DC579CA}\WpadDecisionReason = "1"	foldersreadand.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCDBC71C-7792-4BBF-9601-BDE99DC579CA}\WpadNetworkName = "Network"	foldersreadand.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1728	foldersreadand.exe
1728	foldersreadand.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1408	1d703d84368e0c53f6706276da6858bdd7df55e6.exe

Suspicious use of UnmapMainImage 4 IoCs

pid	Process
1460	1d703d84368e0c53f6706276da6858bdd7df55e6.exe
1408	1d703d84368e0c53f6706276da6858bdd7df55e6.exe
1724	foldersreadand.exe
1728	foldersreadand.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 1408	1460	1d703d84368e0c53f6706276da6858bdd7df55e6.exe	28
PID 1460 wrote to memory of 1408	1460	1d703d84368e0c53f6706276da6858bdd7df55e6.exe	28
PID 1460 wrote to memory of 1408	1460	1d703d84368e0c53f6706276da6858bdd7df55e6.exe	28
PID 1460 wrote to memory of 1408	1460	1d703d84368e0c53f6706276da6858bdd7df55e6.exe	28
PID 1724 wrote to memory of 1728	1724	foldersreadand.exe	30
PID 1724 wrote to memory of 1728	1724	foldersreadand.exe	30
PID 1724 wrote to memory of 1728	1724	foldersreadand.exe	30
PID 1724 wrote to memory of 1728	1724	foldersreadand.exe	30

C:\Users\Admin\AppData\Local\Temp\1d703d84368e0c53f6706276da6858bdd7df55e6.exe
"C:\Users\Admin\AppData\Local\Temp\1d703d84368e0c53f6706276da6858bdd7df55e6.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Users\Admin\AppData\Local\Temp\1d703d84368e0c53f6706276da6858bdd7df55e6.exe
  --b776edec
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of UnmapMainImage
  PID:1408

C:\Windows\SysWOW64\foldersreadand.exe
"C:\Windows\SysWOW64\foldersreadand.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\foldersreadand.exe
  --52cd4f4e
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:1728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1408-57-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1408-58-0x0000000075D01000-0x0000000075D03000-memory.dmp

Download

memory/1408-59-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1408-61-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/1460-55-0x0000000000230000-0x0000000000247000-memory.dmp

Download

memory/1460-56-0x0000000000400000-0x0000000000419000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads