emotet | 0bc19c1c25a5884dd846841150c9de183a78a509e6480536e5ff723eef4e188a

Analysis

max time kernel
191s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62f23351a5d25faa99ed9a1b5758c285248a4a23.exe
Size

348KB
MD5

2f360e6e56314a35bb273a21ae10f24c
SHA1

62f23351a5d25faa99ed9a1b5758c285248a4a23
SHA256

0bc19c1c25a5884dd846841150c9de183a78a509e6480536e5ff723eef4e188a
SHA512

a22227684cb8e52b3b55f51f35bf86c0e6ca0389da895c00cfd41df0a18a5d626e5077109f572e8cba358d3b85835f666cbe08a27cc02ad24860df1b04b5b7a1
SSDEEP

6144:Th6URLisFqfZLFd+Vc9DbHOwN4q8nD8M+YRhvZMFMWw1:F6aHFqfZLFsc9X4q84OhvZ8M

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

181.59.253.20:21

14.160.93.230:80

74.208.68.48:8080

104.131.58.132:8080

68.183.190.199:8080

62.75.143.100:7080

159.203.204.126:8080

151.80.142.33:80

123.168.4.66:22

46.28.111.142:7080

46.101.212.195:8080

183.82.97.25:80

190.10.194.42:8080

217.199.160.224:8080

186.1.41.111:443

185.86.148.222:8080

185.187.198.10:8080

200.57.102.71:8443

114.79.134.129:443

80.85.87.122:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

skipwce.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	skipwce.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	skipwce.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	skipwce.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	skipwce.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

skipwce.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	skipwce.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	skipwce.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	skipwce.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

skipwce.exe

pid process

360 skipwce.exe
360 skipwce.exe
360 skipwce.exe
360 skipwce.exe
360 skipwce.exe
360 skipwce.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

62f23351a5d25faa99ed9a1b5758c285248a4a23.exe

pid process

3440 62f23351a5d25faa99ed9a1b5758c285248a4a23.exe

pid	process
360	skipwce.exe
360	skipwce.exe
360	skipwce.exe
360	skipwce.exe
360	skipwce.exe
360	skipwce.exe

pid	process
3440	62f23351a5d25faa99ed9a1b5758c285248a4a23.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

62f23351a5d25faa99ed9a1b5758c285248a4a23.exeskipwce.exe

description	pid	process	target process
PID 4260 wrote to memory of 3440	4260	62f23351a5d25faa99ed9a1b5758c285248a4a23.exe	62f23351a5d25faa99ed9a1b5758c285248a4a23.exe
PID 4260 wrote to memory of 3440	4260	62f23351a5d25faa99ed9a1b5758c285248a4a23.exe	62f23351a5d25faa99ed9a1b5758c285248a4a23.exe
PID 4260 wrote to memory of 3440	4260	62f23351a5d25faa99ed9a1b5758c285248a4a23.exe	62f23351a5d25faa99ed9a1b5758c285248a4a23.exe
PID 4252 wrote to memory of 360	4252	skipwce.exe	skipwce.exe
PID 4252 wrote to memory of 360	4252	skipwce.exe	skipwce.exe
PID 4252 wrote to memory of 360	4252	skipwce.exe	skipwce.exe

C:\Users\Admin\AppData\Local\Temp\62f23351a5d25faa99ed9a1b5758c285248a4a23.exe
"C:\Users\Admin\AppData\Local\Temp\62f23351a5d25faa99ed9a1b5758c285248a4a23.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4260

C:\Users\Admin\AppData\Local\Temp\62f23351a5d25faa99ed9a1b5758c285248a4a23.exe
--47c915dd
2⤵
- Suspicious behavior: RenamesItself
PID:3440

C:\Windows\SysWOW64\skipwce.exe
"C:\Windows\SysWOW64\skipwce.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4252

C:\Windows\SysWOW64\skipwce.exe
--2c52f6b0
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:360

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/360-150-0x0000000000000000-mapping.dmp

Download
memory/360-151-0x0000000000DD0000-0x0000000000DE7000-memory.dmp

Filesize
92KB

Download
memory/3440-138-0x0000000000000000-mapping.dmp

Download
memory/3440-140-0x00000000004F0000-0x0000000000507000-memory.dmp

Filesize
92KB

Download
memory/4252-145-0x00000000005F0000-0x0000000000607000-memory.dmp

Filesize
92KB

Download
memory/4260-133-0x0000000000720000-0x0000000000737000-memory.dmp

Filesize
92KB

Download
memory/4260-139-0x00000000005F0000-0x0000000000600000-memory.dmp

Filesize
64KB

Download