emotet | 622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594

General

Target

622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594.exe
Size

474KB
MD5

b96235b9e1570648834439e99317b461
SHA1

ce5eef6c6e30fc62ee0c7d1311fcac4254a85491
SHA256

622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594
SHA512

6143d51d5b599195c6cfc53bc7c86d03f6bf78d7106908f50b385e2314d979e0ecee1e38be56a94f805d6d26b2619f7311d3125b0b2ba2b7aae44f5d41a57351
SSDEEP

6144:0lz4Ie8TvPgADDnz/HXnr/vYito3LFDPMTJYhr64Fg0:84Iuim3LFPMdV4Fg0

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

181.123.0.125:80

119.159.150.176:443

184.69.214.94:20

80.240.141.141:7080

185.187.198.10:8080

46.41.134.46:8080

178.249.187.151:8080

217.199.160.224:8080

186.83.133.253:8080

23.92.22.225:7080

212.71.237.140:8080

190.221.50.210:8080

187.199.158.226:443

185.86.148.222:8080

200.58.171.51:80

77.245.101.134:8080

201.163.74.202:443

203.25.159.3:8080

183.82.97.25:80

51.15.8.192:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

soundseasy.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	soundseasy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

soundseasy.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	soundseasy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	soundseasy.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BD494073-7181-4B65-8F37-F565ACDBF9F6}\WpadNetworkName = "Network 2"	soundseasy.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	soundseasy.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	soundseasy.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	soundseasy.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BD494073-7181-4B65-8F37-F565ACDBF9F6}\WpadDecisionTime = b0d765675606d901	soundseasy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BD494073-7181-4B65-8F37-F565ACDBF9F6}\9a-cb-ce-21-d5-58	soundseasy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-cb-ce-21-d5-58\WpadDecisionReason = "1"	soundseasy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-cb-ce-21-d5-58\WpadDecision = "0"	soundseasy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	soundseasy.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	soundseasy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	soundseasy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	soundseasy.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f001c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	soundseasy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BD494073-7181-4B65-8F37-F565ACDBF9F6}\WpadDecision = "0"	soundseasy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-cb-ce-21-d5-58	soundseasy.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-cb-ce-21-d5-58\WpadDecisionTime = b0d765675606d901	soundseasy.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	soundseasy.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BD494073-7181-4B65-8F37-F565ACDBF9F6}	soundseasy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BD494073-7181-4B65-8F37-F565ACDBF9F6}\WpadDecisionReason = "1"	soundseasy.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

soundseasy.exe

pid process

804 soundseasy.exe
804 soundseasy.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594.exe

pid process

1992 622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594.exe

pid	process
804	soundseasy.exe
804	soundseasy.exe

pid	process
1992	622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1244	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1244	AUDIODG.EXE
Token: 33	1244	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1244	AUDIODG.EXE

Suspicious use of UnmapMainImage 4 IoCs

Processes:

622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594.exe622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594.exesoundseasy.exesoundseasy.exe

pid	process
1676	622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594.exe
1992	622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594.exe
1336	soundseasy.exe
804	soundseasy.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594.exesoundseasy.exe

description	pid	process	target process
PID 1676 wrote to memory of 1992	1676	622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594.exe	622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594.exe
PID 1676 wrote to memory of 1992	1676	622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594.exe	622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594.exe
PID 1676 wrote to memory of 1992	1676	622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594.exe	622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594.exe
PID 1676 wrote to memory of 1992	1676	622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594.exe	622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594.exe
PID 1336 wrote to memory of 804	1336	soundseasy.exe	soundseasy.exe
PID 1336 wrote to memory of 804	1336	soundseasy.exe	soundseasy.exe
PID 1336 wrote to memory of 804	1336	soundseasy.exe	soundseasy.exe
PID 1336 wrote to memory of 804	1336	soundseasy.exe	soundseasy.exe

C:\Users\Admin\AppData\Local\Temp\622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594.exe
"C:\Users\Admin\AppData\Local\Temp\622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1676

C:\Users\Admin\AppData\Local\Temp\622a1a8f9ed850f507b177e8098084a440cb204c60b1e6a1b9b023c98c91c594.exe
--4ae089ce
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:1992

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x51c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1244

C:\Windows\SysWOW64\soundseasy.exe
"C:\Windows\SysWOW64\soundseasy.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\SysWOW64\soundseasy.exe
--9cfed398
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:804

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/804-62-0x0000000000000000-mapping.dmp

Download
memory/1676-54-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download
memory/1676-55-0x0000000000320000-0x0000000000335000-memory.dmp

Filesize
84KB

Download
memory/1676-58-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1676-57-0x0000000000320000-0x0000000000335000-memory.dmp

Filesize
84KB

Download
memory/1992-56-0x0000000000000000-mapping.dmp

Download
memory/1992-60-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1992-63-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads