emotet | c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2

General

Target

c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe
Size

244KB
MD5

4476793a918bbd7df4ad6fc9d3c5ecab
SHA1

70d790451e55facc6d1177bb4d7cf198490e0f8a
SHA256

c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2
SHA512

cc610db3fc40e51d3a27aee15b35a3f4f67f5a48f72123c8ffab4777a97e12e9b9a1542c529c87f0e464daa4f18a392d391c2d14621c2d0553c7819d67e092d0
SSDEEP

6144:uaYl0wVsoWPdPyThWhzhaA5Umd5ijA/YlfhL+Nh:uUwVYt68bndiuY9MN

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

105.186.87.144:80

186.75.241.230:80

200.21.90.6:80

212.129.24.82:8080

162.144.47.94:7080

77.237.248.136:8080

185.142.236.163:443

63.142.253.122:8080

190.145.67.134:8090

182.176.132.213:8090

88.247.163.44:80

85.106.1.166:50000

45.123.3.54:443

37.157.194.134:443

142.44.162.209:8080

159.65.25.128:8080

190.211.207.11:443

85.104.59.244:20

201.251.43.69:8080

101.187.237.217:20

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

durablesounds.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	durablesounds.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	durablesounds.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	durablesounds.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	durablesounds.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exec68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exedurablesounds.exedurablesounds.exe

description	pid	process	target process
PID 4876 set thread context of 1436	4876	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe
PID 4388 set thread context of 1256	4388	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe
PID 2892 set thread context of 872	2892	durablesounds.exe	durablesounds.exe
PID 1392 set thread context of 1608	1392	durablesounds.exe	durablesounds.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

durablesounds.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	durablesounds.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	durablesounds.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	durablesounds.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

durablesounds.exe

pid	process
1608	durablesounds.exe
1608	durablesounds.exe
1608	durablesounds.exe
1608	durablesounds.exe
1608	durablesounds.exe
1608	durablesounds.exe
1608	durablesounds.exe
1608	durablesounds.exe
1608	durablesounds.exe
1608	durablesounds.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exec68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exedurablesounds.exedurablesounds.exe

pid	process
4876	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe
4388	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe
2892	durablesounds.exe
1392	durablesounds.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe

pid process

1256 c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe

pid	process
1256	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exec68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exedurablesounds.exedurablesounds.exe

pid	process
4876	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe
4388	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe
2892	durablesounds.exe
1392	durablesounds.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exec68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exec68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exedurablesounds.exedurablesounds.exedurablesounds.exe

description	pid	process	target process
PID 4876 wrote to memory of 1436	4876	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe
PID 4876 wrote to memory of 1436	4876	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe
PID 4876 wrote to memory of 1436	4876	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe
PID 4876 wrote to memory of 1436	4876	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe
PID 1436 wrote to memory of 4388	1436	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe
PID 1436 wrote to memory of 4388	1436	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe
PID 1436 wrote to memory of 4388	1436	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe
PID 4388 wrote to memory of 1256	4388	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe
PID 4388 wrote to memory of 1256	4388	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe
PID 4388 wrote to memory of 1256	4388	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe
PID 4388 wrote to memory of 1256	4388	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe	c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe
PID 2892 wrote to memory of 872	2892	durablesounds.exe	durablesounds.exe
PID 2892 wrote to memory of 872	2892	durablesounds.exe	durablesounds.exe
PID 2892 wrote to memory of 872	2892	durablesounds.exe	durablesounds.exe
PID 2892 wrote to memory of 872	2892	durablesounds.exe	durablesounds.exe
PID 872 wrote to memory of 1392	872	durablesounds.exe	durablesounds.exe
PID 872 wrote to memory of 1392	872	durablesounds.exe	durablesounds.exe
PID 872 wrote to memory of 1392	872	durablesounds.exe	durablesounds.exe
PID 1392 wrote to memory of 1608	1392	durablesounds.exe	durablesounds.exe
PID 1392 wrote to memory of 1608	1392	durablesounds.exe	durablesounds.exe
PID 1392 wrote to memory of 1608	1392	durablesounds.exe	durablesounds.exe
PID 1392 wrote to memory of 1608	1392	durablesounds.exe	durablesounds.exe

C:\Users\Admin\AppData\Local\Temp\c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe
"C:\Users\Admin\AppData\Local\Temp\c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876

C:\Users\Admin\AppData\Local\Temp\c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe
"C:\Users\Admin\AppData\Local\Temp\c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1436

C:\Users\Admin\AppData\Local\Temp\c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe
--3e29a647
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4388

C:\Users\Admin\AppData\Local\Temp\c68eabd43b8f840c9f3604a7e0cfeddf11893371e9d8c26656f49906c19a01c2.exe
--3e29a647
4⤵
- Suspicious behavior: RenamesItself
PID:1256

C:\Windows\SysWOW64\durablesounds.exe
"C:\Windows\SysWOW64\durablesounds.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892

C:\Windows\SysWOW64\durablesounds.exe
"C:\Windows\SysWOW64\durablesounds.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:872

C:\Windows\SysWOW64\durablesounds.exe
--29267415
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\SysWOW64\durablesounds.exe
--29267415
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1608

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/872-147-0x0000000000000000-mapping.dmp

Download
memory/1256-142-0x0000000000000000-mapping.dmp

Download
memory/1256-149-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1256-143-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1392-150-0x0000000000600000-0x0000000000616000-memory.dmp

Filesize
88KB

Download
memory/1392-148-0x0000000000000000-mapping.dmp

Download
memory/1436-137-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1436-135-0x0000000000000000-mapping.dmp

Download
memory/1608-153-0x0000000000000000-mapping.dmp

Download
memory/1608-154-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1608-155-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2892-144-0x00000000005E0000-0x00000000005F6000-memory.dmp

Filesize
88KB

Download
memory/4388-139-0x00000000006F0000-0x0000000000706000-memory.dmp

Filesize
88KB

Download
memory/4388-136-0x0000000000000000-mapping.dmp

Download
memory/4876-132-0x0000000002250000-0x0000000002266000-memory.dmp

Filesize
88KB

Download
memory/4876-138-0x0000000002230000-0x0000000002245000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads