emotet | 9226a5552470fc7a251c1aaf5ca873e15c787cd9f7266e3d3977c8028e4036ce

General

Target

9ce76256d7325af2e34f6c8f58db413c5d43f6fe.exe
Size

260KB
MD5

12cffe89f637a3c6a0c1146acc676727
SHA1

9ce76256d7325af2e34f6c8f58db413c5d43f6fe
SHA256

9226a5552470fc7a251c1aaf5ca873e15c787cd9f7266e3d3977c8028e4036ce
SHA512

bc5d97fcea187f080c8a231ebb41af4c7a7178cb917ee364e3fddfa8f54fced5236bffaa16ad6063d43fd6f1d154cd903c29c710b4f1724fb5375301cd3d0d4b
SSDEEP

3072:/xTuGaG5aUYl8xJElSNtWK4P+Ni9eqtVyxsr60CzVAOYF7rXJ+7ouJ:pThx5aUYl8QlSNkWirtVyQ60Cpc7

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

110.36.234.146:80

191.82.16.60:80

91.83.93.105:8080

216.98.148.181:8080

68.183.190.199:8080

190.230.60.129:80

183.82.97.25:80

114.79.134.129:443

89.188.124.145:443

178.79.163.131:8080

76.69.29.42:80

87.106.77.40:7080

178.249.187.151:8080

62.75.143.100:7080

201.163.74.202:443

62.75.160.178:8080

181.188.149.134:80

186.0.95.172:80

217.199.160.224:8080

203.25.159.3:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

cablebackup.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	cablebackup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

cablebackup.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	cablebackup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	cablebackup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	cablebackup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	cablebackup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	cablebackup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B9816B66-E87A-44A3-8422-ACB6B4AC00EF}	cablebackup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B9816B66-E87A-44A3-8422-ACB6B4AC00EF}\WpadDecisionReason = "1"	cablebackup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B9816B66-E87A-44A3-8422-ACB6B4AC00EF}\WpadNetworkName = "Network 2"	cablebackup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	cablebackup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	cablebackup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B9816B66-E87A-44A3-8422-ACB6B4AC00EF}\WpadDecision = "0"	cablebackup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-11-61-01-ab-2e	cablebackup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B9816B66-E87A-44A3-8422-ACB6B4AC00EF}\c2-11-61-01-ab-2e	cablebackup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-11-61-01-ab-2e\WpadDecisionTime = 803af197a504d901	cablebackup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-11-61-01-ab-2e\WpadDecision = "0"	cablebackup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	cablebackup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	cablebackup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	cablebackup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0046000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	cablebackup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B9816B66-E87A-44A3-8422-ACB6B4AC00EF}\WpadDecisionTime = 803af197a504d901	cablebackup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-11-61-01-ab-2e\WpadDecisionReason = "1"	cablebackup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

cablebackup.exe

pid process

1268 cablebackup.exe
1268 cablebackup.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

9ce76256d7325af2e34f6c8f58db413c5d43f6fe.exe

pid process

1344 9ce76256d7325af2e34f6c8f58db413c5d43f6fe.exe

pid	process
1268	cablebackup.exe
1268	cablebackup.exe

pid	process
1344	9ce76256d7325af2e34f6c8f58db413c5d43f6fe.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

9ce76256d7325af2e34f6c8f58db413c5d43f6fe.execablebackup.exe

description	pid	process	target process
PID 1180 wrote to memory of 1344	1180	9ce76256d7325af2e34f6c8f58db413c5d43f6fe.exe	9ce76256d7325af2e34f6c8f58db413c5d43f6fe.exe
PID 1180 wrote to memory of 1344	1180	9ce76256d7325af2e34f6c8f58db413c5d43f6fe.exe	9ce76256d7325af2e34f6c8f58db413c5d43f6fe.exe
PID 1180 wrote to memory of 1344	1180	9ce76256d7325af2e34f6c8f58db413c5d43f6fe.exe	9ce76256d7325af2e34f6c8f58db413c5d43f6fe.exe
PID 1180 wrote to memory of 1344	1180	9ce76256d7325af2e34f6c8f58db413c5d43f6fe.exe	9ce76256d7325af2e34f6c8f58db413c5d43f6fe.exe
PID 520 wrote to memory of 1268	520	cablebackup.exe	cablebackup.exe
PID 520 wrote to memory of 1268	520	cablebackup.exe	cablebackup.exe
PID 520 wrote to memory of 1268	520	cablebackup.exe	cablebackup.exe
PID 520 wrote to memory of 1268	520	cablebackup.exe	cablebackup.exe

C:\Users\Admin\AppData\Local\Temp\9ce76256d7325af2e34f6c8f58db413c5d43f6fe.exe
"C:\Users\Admin\AppData\Local\Temp\9ce76256d7325af2e34f6c8f58db413c5d43f6fe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1180

C:\Users\Admin\AppData\Local\Temp\9ce76256d7325af2e34f6c8f58db413c5d43f6fe.exe
--78f9bdcd
2⤵
- Suspicious behavior: RenamesItself
PID:1344

C:\Windows\SysWOW64\cablebackup.exe
"C:\Windows\SysWOW64\cablebackup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:520

C:\Windows\SysWOW64\cablebackup.exe
--e8baedd5
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1268

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1180-54-0x0000000000230000-0x0000000000247000-memory.dmp

Filesize
92KB

Download
memory/1180-60-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1268-72-0x0000000000000000-mapping.dmp

Download
memory/1268-73-0x00000000002F0000-0x0000000000307000-memory.dmp

Filesize
92KB

Download
memory/1344-59-0x0000000000000000-mapping.dmp

Download
memory/1344-66-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads