emotet | 6fa0dd6002d4b4e7ebabefc7f4f90f36fc53069e0cf4e845f683fb087d476e90

General

Target

genericpixel.exe
Size

490KB
MD5

f4d1470af3a7d82560b38558b132d468
SHA1

0c45cf4e32116eae8d73b52c140f5d91a19ee8ea
SHA256

6fa0dd6002d4b4e7ebabefc7f4f90f36fc53069e0cf4e845f683fb087d476e90
SHA512

1f45093e1509d86ab03ee2c6f15a6dbc3ed4f41cac3c8faf5ae66445b787b58bf9e69d047d7ead3d1d22284d351fbb739a7a7eb73180f746f3d4f621859206c8
SSDEEP

12288:x1n6BAlECcMIR4WlptZ2uOIR4bi6/Myw52BLhDG5Fq:x16SbcMMlpLLOS

Score

10^/10

emotet epoch3 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

190.117.206.153:443

203.99.187.137:443

200.55.168.82:20

70.32.94.58:8080

213.138.100.98:8080

144.76.62.10:8080

203.99.188.203:990

201.196.15.79:990

203.99.182.135:443

176.58.93.123:80

192.241.220.183:8080

94.177.253.126:80

181.47.235.26:993

216.75.37.196:8080

95.216.207.86:7080

78.109.34.178:443

113.52.135.33:7080

216.70.88.55:8080

138.197.140.163:8080

181.113.229.139:990

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

editionclass.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	editionclass.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	editionclass.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	editionclass.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	editionclass.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

editionclass.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	editionclass.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	editionclass.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	editionclass.exe

Modifies registry class 64 IoCs

Processes:

genericpixel.exeeditionclass.exegenericpixel.exeeditionclass.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew	genericpixel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\ = "Recalc Document"	editionclass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec	editionclass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command\ = "C:\\Windows\\SysWOW64\\EDITIO~1.EXE /dde"	editionclass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ = "Recalc.Document.1"	genericpixel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command\ = "C:\\Windows\\SysWOW64\\EDITIO~1.EXE /dde"	editionclass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command\ = "C:\\Windows\\SysWOW64\\EDITIO~1.EXE /dde"	editionclass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	editionclass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command\ = "C:\\Windows\\SysWOW64\\EDITIO~1.EXE /dde"	editionclass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1	genericpixel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec	genericpixel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command	genericpixel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]"	editionclass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]"	editionclass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command	editionclass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew\NullFile	editionclass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon	editionclass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec\ = "[open(\"%1\")]"	editionclass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec	editionclass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]"	genericpixel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command	genericpixel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec	genericpixel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GENERI~1.EXE /dde"	genericpixel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon	editionclass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec	editionclass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command	editionclass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command\ = "C:\\Windows\\SysWOW64\\EDITIO~1.EXE /dde"	editionclass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL	editionclass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command	genericpixel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GENERI~1.EXE /dde"	genericpixel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1	genericpixel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon\ = "C:\\Windows\\SysWOW64\\EDITIO~1.EXE,0"	editionclass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\ = "Recalc Document"	editionclass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	editionclass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec	genericpixel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL	genericpixel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ = "Recalc.Document.1"	genericpixel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew\NullFile	genericpixel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command	genericpixel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GENERI~1.EXE /dde"	genericpixel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec	editionclass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command	editionclass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GENERI~1.EXE /dde"	genericpixel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec	editionclass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL	editionclass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew	editionclass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command	editionclass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\ = "Recalc Document"	genericpixel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto	genericpixel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon	genericpixel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec	editionclass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command	genericpixel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew\NullFile	genericpixel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec\ = "[open(\"%1\")]"	editionclass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command	editionclass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command	genericpixel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ = "Recalc.Document.1"	editionclass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ = "Recalc.Document.1"	editionclass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GENERI~1.EXE,0"	genericpixel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec\ = "[open(\"%1\")]"	genericpixel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec	genericpixel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec	genericpixel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1	editionclass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command	editionclass.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

editionclass.exe

pid	process
4140	editionclass.exe
4140	editionclass.exe
4140	editionclass.exe
4140	editionclass.exe
4140	editionclass.exe
4140	editionclass.exe
4140	editionclass.exe
4140	editionclass.exe
4140	editionclass.exe
4140	editionclass.exe
4140	editionclass.exe
4140	editionclass.exe
4140	editionclass.exe
4140	editionclass.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

genericpixel.exe

pid process

4396 genericpixel.exe

pid	process
4396	genericpixel.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

genericpixel.exegenericpixel.exeeditionclass.exeeditionclass.exe

pid	process
4948	genericpixel.exe
4948	genericpixel.exe
4396	genericpixel.exe
4396	genericpixel.exe
3504	editionclass.exe
3504	editionclass.exe
4140	editionclass.exe
4140	editionclass.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

genericpixel.exeeditionclass.exe

description	pid	process	target process
PID 4948 wrote to memory of 4396	4948	genericpixel.exe	genericpixel.exe
PID 4948 wrote to memory of 4396	4948	genericpixel.exe	genericpixel.exe
PID 4948 wrote to memory of 4396	4948	genericpixel.exe	genericpixel.exe
PID 3504 wrote to memory of 4140	3504	editionclass.exe	editionclass.exe
PID 3504 wrote to memory of 4140	3504	editionclass.exe	editionclass.exe
PID 3504 wrote to memory of 4140	3504	editionclass.exe	editionclass.exe

C:\Users\Admin\AppData\Local\Temp\genericpixel.exe
"C:\Users\Admin\AppData\Local\Temp\genericpixel.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4948

C:\Users\Admin\AppData\Local\Temp\genericpixel.exe
--a30a1053
2⤵
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:4396

C:\Windows\SysWOW64\editionclass.exe
"C:\Windows\SysWOW64\editionclass.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3504

C:\Windows\SysWOW64\editionclass.exe
--a382bf0c
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4140

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3504-144-0x0000000000DB0000-0x0000000000DC6000-memory.dmp

Filesize
88KB

Download
memory/4140-149-0x0000000000000000-mapping.dmp

Download
memory/4140-150-0x0000000000E60000-0x0000000000E76000-memory.dmp

Filesize
88KB

Download
memory/4396-137-0x0000000000000000-mapping.dmp

Download
memory/4396-138-0x00000000021D0000-0x00000000021E6000-memory.dmp

Filesize
88KB

Download
memory/4948-132-0x00000000022F0000-0x0000000002306000-memory.dmp

Filesize
88KB

Download
memory/4948-143-0x00000000022D0000-0x00000000022E0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads