emotet | 3ed3759a7759fd6cffc0bddfc01d262f1a8a47b10ee5c4c2192547f7f47683d1

General

Target

5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Size

596KB
MD5

2c4d542a55d21e92352d798b47f5fada
SHA1

5b08375c935c2e2b2b8f59583dabe7ecc301a65f
SHA256

3ed3759a7759fd6cffc0bddfc01d262f1a8a47b10ee5c4c2192547f7f47683d1
SHA512

25ba8b1f48bd9e5ef7f293cb9afb53c2e399c119317eb1cde934ce55337d75986aeecbc1001e536cf1bfd765f757d3241294ee5f55596d383cd1a5f2a3a23a21
SSDEEP

12288:XOznWAlABfLGB5kvtjV7uikFgXLNJ7HCxH5:mSoB5wdlubgXLNJCxH5

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

125.99.61.162:7080

94.183.71.206:7080

91.83.93.105:8080

216.98.148.181:8080

68.183.190.199:8080

170.84.133.72:7080

139.5.237.27:443

5.77.13.70:80

46.29.183.211:8080

46.41.151.103:8080

182.188.39.68:80

170.84.133.72:8443

186.83.133.253:8080

46.28.111.142:7080

62.75.160.178:8080

178.79.163.131:8080

190.104.253.234:990

149.62.173.247:8080

178.249.187.151:8080

81.169.140.14:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

minimummaker.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	minimummaker.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	minimummaker.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	minimummaker.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	minimummaker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

minimummaker.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	minimummaker.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	minimummaker.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	minimummaker.exe

Modifies registry class 64 IoCs

Processes:

minimummaker.exe5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exeminimummaker.exe5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon\ = "C:\\Windows\\SysWOW64\\MINIMU~1.EXE,0"	minimummaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ = "Recalc.Document.1"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec	minimummaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec	minimummaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL	minimummaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ = "Recalc.Document.1"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]"	minimummaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command	minimummaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew	minimummaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command	minimummaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command	minimummaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1	minimummaker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\ = "Recalc Document"	minimummaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon	minimummaker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command\ = "C:\\Windows\\SysWOW64\\MINIMU~1.EXE /dde"	minimummaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command	minimummaker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\ = "Recalc Document"	minimummaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon	minimummaker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon\ = "C:\\Windows\\SysWOW64\\MINIMU~1.EXE,0"	minimummaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec	minimummaker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	minimummaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command\ = "C:\\Windows\\SysWOW64\\MINIMU~1.EXE /dde"	minimummaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec\ = "[open(\"%1\")]"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5B0837~1.EXE /dde"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec	minimummaker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew\NullFile	minimummaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec	minimummaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew\NullFile	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5B0837~1.EXE,0"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew\NullFile	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL	minimummaker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew\NullFile	minimummaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5B0837~1.EXE /dde"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	minimummaker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]"	minimummaker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command\ = "C:\\Windows\\SysWOW64\\MINIMU~1.EXE /dde"	minimummaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command	minimummaker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ = "Recalc.Document.1"	minimummaker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\ = "Recalc Document"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec\ = "[open(\"%1\")]"	minimummaker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command\ = "C:\\Windows\\SysWOW64\\MINIMU~1.EXE /dde"	minimummaker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5B0837~1.EXE,0"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

minimummaker.exe

pid	process
5076	minimummaker.exe
5076	minimummaker.exe
5076	minimummaker.exe
5076	minimummaker.exe
5076	minimummaker.exe
5076	minimummaker.exe
5076	minimummaker.exe
5076	minimummaker.exe
5076	minimummaker.exe
5076	minimummaker.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe

pid process

5020 5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe

pid	process
5020	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exeminimummaker.exeminimummaker.exe

pid	process
3868	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
3868	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
5020	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
5020	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
4396	minimummaker.exe
4396	minimummaker.exe
5076	minimummaker.exe
5076	minimummaker.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exeminimummaker.exe

description	pid	process	target process
PID 3868 wrote to memory of 5020	3868	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
PID 3868 wrote to memory of 5020	3868	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
PID 3868 wrote to memory of 5020	3868	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
PID 4396 wrote to memory of 5076	4396	minimummaker.exe	minimummaker.exe
PID 4396 wrote to memory of 5076	4396	minimummaker.exe	minimummaker.exe
PID 4396 wrote to memory of 5076	4396	minimummaker.exe	minimummaker.exe

C:\Users\Admin\AppData\Local\Temp\5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
"C:\Users\Admin\AppData\Local\Temp\5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3868

C:\Users\Admin\AppData\Local\Temp\5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
--86b673f4
2⤵
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:5020

C:\Windows\SysWOW64\minimummaker.exe
"C:\Windows\SysWOW64\minimummaker.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4396

C:\Windows\SysWOW64\minimummaker.exe
--2272efe8
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5076

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3868-132-0x0000000002290000-0x00000000022A7000-memory.dmp

Filesize
92KB

Download
memory/3868-138-0x0000000002260000-0x0000000002270000-memory.dmp

Filesize
64KB

Download
memory/4396-144-0x0000000000E50000-0x0000000000E67000-memory.dmp

Filesize
92KB

Download
memory/5020-137-0x0000000000000000-mapping.dmp

Download
memory/5020-139-0x00000000021C0000-0x00000000021D7000-memory.dmp

Filesize
92KB

Download
memory/5076-149-0x0000000000000000-mapping.dmp

Download
memory/5076-150-0x0000000000DC0000-0x0000000000DD7000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads