emotet | 3aa21ecf0d173cc8e23a6deada7807e1d73dc39035d7d97bb16a0e6a5c0f4a3e

Analysis

max time kernel
163s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 17:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3aa21ecf0d173cc8e23a6deada7807e1d73dc39035d7d97bb16a0e6a5c0f4a3e.exe
Size

113KB
MD5

51745a9cf568638991d74644a0e104d2
SHA1

91467044f6e59db3b52852349fc669023b8ae986
SHA256

3aa21ecf0d173cc8e23a6deada7807e1d73dc39035d7d97bb16a0e6a5c0f4a3e
SHA512

3140bc473191deb590e5d3a394c9cc2ec6ebe6b2d9e8ae0a6dc2c1c6cd034a8d7bc171030724dce5c0d1a82159234f757d1f6465c83119bf8077689f5334f459
SSDEEP

3072:SXal9qoo7GTJrl+3oZ1mA0rk9pM84WGwKFeE2v8rg:igX5FzpPvK4E2z

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

81.109.227.123:80

82.15.36.209:443

142.4.198.249:7080

162.144.119.216:8080

142.93.88.16:443

31.12.67.62:7080

91.83.93.103:7080

178.152.78.149:20

104.131.208.175:8080

136.243.177.26:8080

206.189.98.125:8080

178.79.161.166:443

195.242.117.231:8080

187.163.222.244:465

186.144.64.31:53

104.236.99.225:8080

71.244.60.230:8080

91.205.215.66:8080

212.71.234.16:8080

190.25.255.98:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

tasksflows.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	tasksflows.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	tasksflows.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	tasksflows.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	tasksflows.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

tasksflows.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	tasksflows.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	tasksflows.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	tasksflows.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

tasksflows.exe

pid	process
1284	tasksflows.exe
1284	tasksflows.exe
1284	tasksflows.exe
1284	tasksflows.exe
1284	tasksflows.exe
1284	tasksflows.exe
1284	tasksflows.exe
1284	tasksflows.exe
1284	tasksflows.exe
1284	tasksflows.exe
1284	tasksflows.exe
1284	tasksflows.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

3aa21ecf0d173cc8e23a6deada7807e1d73dc39035d7d97bb16a0e6a5c0f4a3e.exe

pid process

5112 3aa21ecf0d173cc8e23a6deada7807e1d73dc39035d7d97bb16a0e6a5c0f4a3e.exe

pid	process
5112	3aa21ecf0d173cc8e23a6deada7807e1d73dc39035d7d97bb16a0e6a5c0f4a3e.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3aa21ecf0d173cc8e23a6deada7807e1d73dc39035d7d97bb16a0e6a5c0f4a3e.exetasksflows.exe

description	pid	process	target process
PID 3612 wrote to memory of 5112	3612	3aa21ecf0d173cc8e23a6deada7807e1d73dc39035d7d97bb16a0e6a5c0f4a3e.exe	3aa21ecf0d173cc8e23a6deada7807e1d73dc39035d7d97bb16a0e6a5c0f4a3e.exe
PID 3612 wrote to memory of 5112	3612	3aa21ecf0d173cc8e23a6deada7807e1d73dc39035d7d97bb16a0e6a5c0f4a3e.exe	3aa21ecf0d173cc8e23a6deada7807e1d73dc39035d7d97bb16a0e6a5c0f4a3e.exe
PID 3612 wrote to memory of 5112	3612	3aa21ecf0d173cc8e23a6deada7807e1d73dc39035d7d97bb16a0e6a5c0f4a3e.exe	3aa21ecf0d173cc8e23a6deada7807e1d73dc39035d7d97bb16a0e6a5c0f4a3e.exe
PID 2196 wrote to memory of 1284	2196	tasksflows.exe	tasksflows.exe
PID 2196 wrote to memory of 1284	2196	tasksflows.exe	tasksflows.exe
PID 2196 wrote to memory of 1284	2196	tasksflows.exe	tasksflows.exe

C:\Users\Admin\AppData\Local\Temp\3aa21ecf0d173cc8e23a6deada7807e1d73dc39035d7d97bb16a0e6a5c0f4a3e.exe
"C:\Users\Admin\AppData\Local\Temp\3aa21ecf0d173cc8e23a6deada7807e1d73dc39035d7d97bb16a0e6a5c0f4a3e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3612

C:\Users\Admin\AppData\Local\Temp\3aa21ecf0d173cc8e23a6deada7807e1d73dc39035d7d97bb16a0e6a5c0f4a3e.exe
--936b2ac
2⤵
- Suspicious behavior: RenamesItself
PID:5112

C:\Windows\SysWOW64\tasksflows.exe
"C:\Windows\SysWOW64\tasksflows.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2196

C:\Windows\SysWOW64\tasksflows.exe
--2acec0a9
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1284

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1284-137-0x0000000000000000-mapping.dmp

Download
memory/1284-139-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1284-140-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3612-134-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3612-133-0x00000000004E0000-0x00000000004F0000-memory.dmp

Filesize
64KB

Download
memory/5112-132-0x0000000000000000-mapping.dmp

Download
memory/5112-135-0x00000000004A0000-0x00000000004B0000-memory.dmp

Filesize
64KB

Download
memory/5112-136-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5112-138-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download