emotet | 0a91ca038be80280f9e9e300dafd4490be9269d1ad7649f102aa5c58b7d7a9db

General

Target

7f8833e01027753003c2540ec9e723e3feb93e83.exe
Size

492KB
MD5

4a0e07690ba066341d7cd8df29daf966
SHA1

7f8833e01027753003c2540ec9e723e3feb93e83
SHA256

0a91ca038be80280f9e9e300dafd4490be9269d1ad7649f102aa5c58b7d7a9db
SHA512

b14d00b021393fee638a8ade28155bd0738844cacb8ca55fe5df77a891da43fb57fd31d2f7f0e0164356e7206a47a64b06ff42d012772ab0ed65970aaa007a6a
SSDEEP

12288:f1n6BAlECcMIR4WlptZ2uOIR4bi6/Myw52BLhzqzE:f16SbcMMlpLLO6E

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

110.36.234.146:80

191.82.16.60:80

91.83.93.105:8080

216.98.148.181:8080

68.183.190.199:8080

190.230.60.129:80

183.82.97.25:80

114.79.134.129:443

89.188.124.145:443

178.79.163.131:8080

76.69.29.42:80

87.106.77.40:7080

178.249.187.151:8080

62.75.143.100:7080

201.163.74.202:443

62.75.160.178:8080

181.188.149.134:80

186.0.95.172:80

217.199.160.224:8080

203.25.159.3:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1100 680 WerFault.exe kdsresapi.exe

pid	pid_target	process	target process
1100	680	WerFault.exe	kdsresapi.exe

Modifies registry class 64 IoCs

Processes:

7f8833e01027753003c2540ec9e723e3feb93e83.exekdsresapi.exe7f8833e01027753003c2540ec9e723e3feb93e83.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7F8833~1.EXE /dde"	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec	kdsresapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	kdsresapi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command	kdsresapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]"	kdsresapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command\ = "C:\\Windows\\SysWOW64\\KDSRES~1.EXE /dde"	kdsresapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec\ = "[open(\"%1\")]"	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\ = "Recalc Document"	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ = "Recalc.Document.1"	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon	kdsresapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command\ = "C:\\Windows\\SysWOW64\\KDSRES~1.EXE /dde"	kdsresapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ = "Recalc.Document.1"	kdsresapi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec	kdsresapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command\ = "C:\\Windows\\SysWOW64\\KDSRES~1.EXE /dde"	kdsresapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon\ = "C:\\Windows\\SysWOW64\\KDSRES~1.EXE,0"	kdsresapi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7F8833~1.EXE /dde"	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7F8833~1.EXE /dde"	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]"	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]"	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew\NullFile	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command	kdsresapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7F8833~1.EXE,0"	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew\NullFile	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec\ = "[open(\"%1\")]"	kdsresapi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew	kdsresapi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7F8833~1.EXE /dde"	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7F8833~1.EXE /dde"	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ = "Recalc.Document.1"	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec\ = "[open(\"%1\")]"	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command	kdsresapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew\NullFile	kdsresapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\ = "Recalc Document"	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\ = "Recalc Document"	kdsresapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1	kdsresapi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL	kdsresapi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7F8833~1.EXE /dde"	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7F8833~1.EXE,0"	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec	kdsresapi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell	7f8833e01027753003c2540ec9e723e3feb93e83.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL	7f8833e01027753003c2540ec9e723e3feb93e83.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

7f8833e01027753003c2540ec9e723e3feb93e83.exe

pid process

592 7f8833e01027753003c2540ec9e723e3feb93e83.exe

pid	process
592	7f8833e01027753003c2540ec9e723e3feb93e83.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

7f8833e01027753003c2540ec9e723e3feb93e83.exe7f8833e01027753003c2540ec9e723e3feb93e83.exekdsresapi.exe

pid	process
1812	7f8833e01027753003c2540ec9e723e3feb93e83.exe
1812	7f8833e01027753003c2540ec9e723e3feb93e83.exe
592	7f8833e01027753003c2540ec9e723e3feb93e83.exe
592	7f8833e01027753003c2540ec9e723e3feb93e83.exe
680	kdsresapi.exe
680	kdsresapi.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

7f8833e01027753003c2540ec9e723e3feb93e83.exekdsresapi.exe

description	pid	process	target process
PID 1812 wrote to memory of 592	1812	7f8833e01027753003c2540ec9e723e3feb93e83.exe	7f8833e01027753003c2540ec9e723e3feb93e83.exe
PID 1812 wrote to memory of 592	1812	7f8833e01027753003c2540ec9e723e3feb93e83.exe	7f8833e01027753003c2540ec9e723e3feb93e83.exe
PID 1812 wrote to memory of 592	1812	7f8833e01027753003c2540ec9e723e3feb93e83.exe	7f8833e01027753003c2540ec9e723e3feb93e83.exe
PID 1812 wrote to memory of 592	1812	7f8833e01027753003c2540ec9e723e3feb93e83.exe	7f8833e01027753003c2540ec9e723e3feb93e83.exe
PID 680 wrote to memory of 1100	680	kdsresapi.exe	WerFault.exe
PID 680 wrote to memory of 1100	680	kdsresapi.exe	WerFault.exe
PID 680 wrote to memory of 1100	680	kdsresapi.exe	WerFault.exe
PID 680 wrote to memory of 1100	680	kdsresapi.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7f8833e01027753003c2540ec9e723e3feb93e83.exe
"C:\Users\Admin\AppData\Local\Temp\7f8833e01027753003c2540ec9e723e3feb93e83.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812

C:\Users\Admin\AppData\Local\Temp\7f8833e01027753003c2540ec9e723e3feb93e83.exe
--18f5e13d
2⤵
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:592

C:\Windows\SysWOW64\kdsresapi.exe
"C:\Windows\SysWOW64\kdsresapi.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 680 -s 240
2⤵
- Program crash
PID:1100

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/592-60-0x0000000000000000-mapping.dmp

Download
memory/592-63-0x0000000000290000-0x00000000002A7000-memory.dmp

Filesize
92KB

Download
memory/1100-69-0x0000000000000000-mapping.dmp

Download
memory/1812-54-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1812-55-0x00000000003A0000-0x00000000003B7000-memory.dmp

Filesize
92KB

Download
memory/1812-61-0x0000000000270000-0x0000000000280000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads