emotet | 09819925fdc296619617875dc4a026ed5657b455c0520c53729430e951e752f2

Analysis

max time kernel
173s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30/11/2022, 06:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1d703d84368e0c53f6706276da6858bdd7df55e6.exe
Size 276KB
Sample221130-gva6msdb56
SHA256 09819925fdc296619617875dc4a026ed5657b455c0520c53729430e951e752f2
MD5 276d2ef178f1d319a7ab74aee99917bf
SHA1 1d703d84368e0c53f6706276da6858bdd7df55e6
SHA512 cf8d467ad34d4612e3b6319f2b8e81df36adeecdc59b6d9377b850755536e2d713badebddaafac882a38c3481e0c2006ce7ad0054129092f71ce63115fa376ba
SSDEEP 3072:7nuxOYPgjfFO+f5/Tx/udGrNGDxD4O8WfRtaG/70Jfm4JuLYwO9/+Tl:OPgjNl/8kIxD4OdpzcflQu1+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

124.240.198.66:80
186.75.241.230:80
181.143.194.138:443
45.79.188.67:8080
77.237.248.136:8080
185.142.236.163:443
63.142.253.122:8080
178.254.6.27:7080
190.211.207.11:443
78.188.105.159:21
182.176.106.43:995
178.79.161.166:443
206.189.98.125:8080
87.230.19.21:8080
80.11.163.139:443
101.187.237.217:20
190.18.146.70:80
86.98.25.30:53
92.222.125.16:7080
186.4.172.5:443
169.239.182.217:8080
189.209.217.49:80
104.236.246.93:8080
190.228.72.244:53
88.247.163.44:80
45.123.3.54:443
91.205.215.66:8080
190.106.97.230:443
199.19.237.192:80
186.4.172.5:20
94.205.247.10:80
104.131.11.150:8080
144.139.247.220:80
119.15.153.237:80
173.212.203.26:8080
136.243.177.26:8080
5.196.74.210:8080
85.104.59.244:20
190.186.203.55:80
187.144.189.58:50000
78.24.219.147:8080
186.4.172.5:8080
46.105.131.87:80
149.167.86.174:990
222.214.218.192:8080
88.156.97.210:80
185.94.252.13:443
190.226.44.20:21
217.145.83.44:80
80.11.163.139:21
138.201.140.110:8080
190.53.135.159:21
31.172.240.91:8080
92.222.216.44:8080
87.106.139.101:8080
159.65.25.128:8080
31.12.67.62:7080
211.63.71.72:8080
179.32.19.219:22
92.233.128.13:143
87.106.136.232:8080
182.176.132.213:8090
37.157.194.134:443
181.143.53.227:21
188.166.253.46:8080
41.220.119.246:80
95.128.43.213:8080
103.97.95.218:143
201.251.43.69:8080
190.108.228.48:990
149.202.153.252:8080
24.51.106.145:21
182.76.6.2:8080
85.106.1.166:50000
62.75.187.192:8080
142.44.162.209:8080
45.33.49.124:443
27.147.163.188:8080
217.160.182.191:8080
212.71.234.16:8080
83.136.245.190:8080
47.41.213.2:22
103.255.150.84:80
200.71.148.138:8080
190.145.67.134:8090

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3952	rtapihistory.exe
3952	rtapihistory.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2704	1d703d84368e0c53f6706276da6858bdd7df55e6.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 2704	4852	1d703d84368e0c53f6706276da6858bdd7df55e6.exe	82
PID 4852 wrote to memory of 2704	4852	1d703d84368e0c53f6706276da6858bdd7df55e6.exe	82
PID 4852 wrote to memory of 2704	4852	1d703d84368e0c53f6706276da6858bdd7df55e6.exe	82
PID 3504 wrote to memory of 3952	3504	rtapihistory.exe	89
PID 3504 wrote to memory of 3952	3504	rtapihistory.exe	89
PID 3504 wrote to memory of 3952	3504	rtapihistory.exe	89

C:\Users\Admin\AppData\Local\Temp\1d703d84368e0c53f6706276da6858bdd7df55e6.exe
"C:\Users\Admin\AppData\Local\Temp\1d703d84368e0c53f6706276da6858bdd7df55e6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Users\Admin\AppData\Local\Temp\1d703d84368e0c53f6706276da6858bdd7df55e6.exe
  --b776edec
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2704

C:\Windows\SysWOW64\rtapihistory.exe
"C:\Windows\SysWOW64\rtapihistory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\SysWOW64\rtapihistory.exe
  --5836c1ee
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2704-138-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/2704-139-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/2704-141-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/3952-142-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/3952-143-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/4852-132-0x00000000004C0000-0x00000000004D7000-memory.dmp

Download

memory/4852-133-0x00000000004C0000-0x00000000004D7000-memory.dmp

Download

memory/4852-134-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/4852-135-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/4852-137-0x0000000000400000-0x0000000000419000-memory.dmp

Download