emotet | 6a6904fe007845787df332920919c2a1f968de70f288a29a410f3e46da5501bd

General

Target

55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Size

492KB
MD5

9547c2132fdd1422d3bcb4de2a95d530
SHA1

55f283c0ee87a122e3b7428a60490bff80da01ac
SHA256

6a6904fe007845787df332920919c2a1f968de70f288a29a410f3e46da5501bd
SHA512

77fa3972a41bc308103efb5b2cd32698d64622afc34b0627e89f2afc32417b02a5127981a41c4b48874e80f98849b15fcfd21025679eebb2e63fb99acc5cd764
SSDEEP

6144:bTj57Z0Lnr0s1pWxD14XLN9JpFAeSeDXrJl3PvgJ6zU5hfQCGw6QpTGHzTvaFbg9:pPs/WIXLHJp2VYXrJ5PvfUvszTvuc

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

110.36.234.146:80

191.82.16.60:80

91.83.93.105:8080

216.98.148.181:8080

68.183.190.199:8080

190.230.60.129:80

183.82.97.25:80

114.79.134.129:443

89.188.124.145:443

178.79.163.131:8080

76.69.29.42:80

87.106.77.40:7080

178.249.187.151:8080

62.75.143.100:7080

201.163.74.202:443

62.75.160.178:8080

181.188.149.134:80

186.0.95.172:80

217.199.160.224:8080

203.25.159.3:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

minimumkds.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	minimumkds.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	minimumkds.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	minimumkds.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	minimumkds.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

minimumkds.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	minimumkds.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	minimumkds.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	minimumkds.exe

Modifies registry class 64 IoCs

Processes:

minimumkds.exeminimumkds.exe55f283c0ee87a122e3b7428a60490bff80da01ac.exe55f283c0ee87a122e3b7428a60490bff80da01ac.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec	minimumkds.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command\ = "C:\\Windows\\SysWOW64\\MINIMU~1.EXE /dde"	minimumkds.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec	minimumkds.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command	minimumkds.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\ = "Recalc Document"	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\55F283~1.EXE,0"	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1	minimumkds.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command\ = "C:\\Windows\\SysWOW64\\MINIMU~1.EXE /dde"	minimumkds.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\55F283~1.EXE /dde"	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\55F283~1.EXE,0"	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command\ = "C:\\Windows\\SysWOW64\\MINIMU~1.EXE /dde"	minimumkds.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command\ = "C:\\Windows\\SysWOW64\\MINIMU~1.EXE /dde"	minimumkds.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\55F283~1.EXE /dde"	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew	minimumkds.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon	minimumkds.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command	minimumkds.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL	minimumkds.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command	minimumkds.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ = "Recalc.Document.1"	minimumkds.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\ = "Recalc Document"	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\ = "Recalc Document"	minimumkds.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command	minimumkds.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec	minimumkds.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]"	minimumkds.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\55F283~1.EXE /dde"	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec\ = "[open(\"%1\")]"	minimumkds.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec\ = "[open(\"%1\")]"	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec	minimumkds.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew\NullFile	minimumkds.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	minimumkds.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew	minimumkds.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew\NullFile	minimumkds.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1	minimumkds.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\ = "Recalc Document"	minimumkds.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]"	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\55F283~1.EXE /dde"	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\55F283~1.EXE /dde"	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec	minimumkds.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	minimumkds.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command	minimumkds.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon\ = "C:\\Windows\\SysWOW64\\MINIMU~1.EXE,0"	minimumkds.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ = "Recalc.Document.1"	minimumkds.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]"	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon	minimumkds.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

minimumkds.exe

pid process

4288 minimumkds.exe
4288 minimumkds.exe
4288 minimumkds.exe
4288 minimumkds.exe
4288 minimumkds.exe
4288 minimumkds.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

55f283c0ee87a122e3b7428a60490bff80da01ac.exe

pid process

5056 55f283c0ee87a122e3b7428a60490bff80da01ac.exe

pid	process
4288	minimumkds.exe
4288	minimumkds.exe
4288	minimumkds.exe
4288	minimumkds.exe
4288	minimumkds.exe
4288	minimumkds.exe

pid	process
5056	55f283c0ee87a122e3b7428a60490bff80da01ac.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

55f283c0ee87a122e3b7428a60490bff80da01ac.exe55f283c0ee87a122e3b7428a60490bff80da01ac.exeminimumkds.exeminimumkds.exe

pid	process
1104	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
1104	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
5056	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
5056	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
1368	minimumkds.exe
1368	minimumkds.exe
4288	minimumkds.exe
4288	minimumkds.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

55f283c0ee87a122e3b7428a60490bff80da01ac.exeminimumkds.exe

description	pid	process	target process
PID 1104 wrote to memory of 5056	1104	55f283c0ee87a122e3b7428a60490bff80da01ac.exe	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
PID 1104 wrote to memory of 5056	1104	55f283c0ee87a122e3b7428a60490bff80da01ac.exe	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
PID 1104 wrote to memory of 5056	1104	55f283c0ee87a122e3b7428a60490bff80da01ac.exe	55f283c0ee87a122e3b7428a60490bff80da01ac.exe
PID 1368 wrote to memory of 4288	1368	minimumkds.exe	minimumkds.exe
PID 1368 wrote to memory of 4288	1368	minimumkds.exe	minimumkds.exe
PID 1368 wrote to memory of 4288	1368	minimumkds.exe	minimumkds.exe

C:\Users\Admin\AppData\Local\Temp\55f283c0ee87a122e3b7428a60490bff80da01ac.exe
"C:\Users\Admin\AppData\Local\Temp\55f283c0ee87a122e3b7428a60490bff80da01ac.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104

C:\Users\Admin\AppData\Local\Temp\55f283c0ee87a122e3b7428a60490bff80da01ac.exe
--76b5081a
2⤵
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:5056

C:\Windows\SysWOW64\minimumkds.exe
"C:\Windows\SysWOW64\minimumkds.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SysWOW64\minimumkds.exe
--3a678dde
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4288

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-132-0x0000000002320000-0x0000000002337000-memory.dmp

Filesize
92KB

Download
memory/1104-137-0x0000000002260000-0x0000000002270000-memory.dmp

Filesize
64KB

Download
memory/1368-144-0x0000000000DC0000-0x0000000000DD7000-memory.dmp

Filesize
92KB

Download
memory/4288-149-0x0000000000000000-mapping.dmp

Download
memory/4288-150-0x0000000000E40000-0x0000000000E57000-memory.dmp

Filesize
92KB

Download
memory/5056-138-0x0000000000000000-mapping.dmp

Download
memory/5056-139-0x00000000021F0000-0x0000000002207000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads