emotet | 045c4ab485bd45781234451af0eae62f23abceae375d5434cff37c3e5620f872

General

Target

fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
Size

477KB
MD5

f1ab1fa6d2b93ae55b448b96733ff195
SHA1

fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f
SHA256

045c4ab485bd45781234451af0eae62f23abceae375d5434cff37c3e5620f872
SHA512

06f5ebb1d2f1079bec579856cd676d256758961dabedc9851836ff22b6442c0efd9ec818b95715b8ee706e126df63322fd7e3ebe679e46bd91e49abb8caf5bd4
SSDEEP

12288:Ur1hcmamspxYUL24xYkPuPN1A27pNMTWdQpDx82540:IDdyxYUmA277MKwDlf

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

181.188.149.134:80

203.130.0.67:80

5.67.96.120:8080

189.245.135.12:143

143.0.245.169:8080

151.80.142.33:80

159.65.241.220:8080

109.104.79.48:8080

43.229.62.186:8080

72.47.248.48:8080

46.249.204.99:8080

181.48.174.242:80

190.230.60.129:80

89.188.124.145:443

187.242.204.142:80

200.57.102.71:8443

201.219.183.243:443

190.117.206.153:443

200.80.198.34:80

138.68.106.4:7080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

watchedcounter.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	watchedcounter.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exefa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exewatchedcounter.exewatchedcounter.exe

description	pid	process	target process
PID 2008 set thread context of 956	2008	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
PID 1652 set thread context of 516	1652	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
PID 580 set thread context of 1296	580	watchedcounter.exe	watchedcounter.exe
PID 856 set thread context of 1072	856	watchedcounter.exe	watchedcounter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

watchedcounter.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	watchedcounter.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{612950B2-9C54-4E16-B1B2-2716F2CB5485}	watchedcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-6f-78-c6-19-1d\WpadDecisionTime = 704d5c760436d901	watchedcounter.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	watchedcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	watchedcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0051000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	watchedcounter.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{612950B2-9C54-4E16-B1B2-2716F2CB5485}\WpadDecision = "0"	watchedcounter.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-6f-78-c6-19-1d\WpadDecision = "0"	watchedcounter.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{612950B2-9C54-4E16-B1B2-2716F2CB5485}\b2-6f-78-c6-19-1d	watchedcounter.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	watchedcounter.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	watchedcounter.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	watchedcounter.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	watchedcounter.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{612950B2-9C54-4E16-B1B2-2716F2CB5485}\WpadDecisionReason = "1"	watchedcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{612950B2-9C54-4E16-B1B2-2716F2CB5485}\WpadDecisionTime = 704d5c760436d901	watchedcounter.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{612950B2-9C54-4E16-B1B2-2716F2CB5485}\WpadNetworkName = "Network 2"	watchedcounter.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-6f-78-c6-19-1d\WpadDecisionReason = "1"	watchedcounter.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	watchedcounter.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	watchedcounter.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	watchedcounter.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-6f-78-c6-19-1d	watchedcounter.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

watchedcounter.exe

pid process

1072 watchedcounter.exe
1072 watchedcounter.exe
1072 watchedcounter.exe
Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exefa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exewatchedcounter.exewatchedcounter.exe

pid process

2008 fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
1652 fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
580 watchedcounter.exe
856 watchedcounter.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe

pid process

516 fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exefa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exewatchedcounter.exewatchedcounter.exe

pid process

2008 fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
1652 fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
580 watchedcounter.exe
856 watchedcounter.exe

pid	process
1072	watchedcounter.exe
1072	watchedcounter.exe
1072	watchedcounter.exe

pid	process
2008	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
1652	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
580	watchedcounter.exe
856	watchedcounter.exe

pid	process
516	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe

pid	process
2008	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
1652	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
580	watchedcounter.exe
856	watchedcounter.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exefa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exefa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exewatchedcounter.exewatchedcounter.exewatchedcounter.exe

description	pid	process	target process
PID 2008 wrote to memory of 956	2008	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
PID 2008 wrote to memory of 956	2008	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
PID 2008 wrote to memory of 956	2008	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
PID 2008 wrote to memory of 956	2008	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
PID 2008 wrote to memory of 956	2008	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
PID 956 wrote to memory of 1652	956	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
PID 956 wrote to memory of 1652	956	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
PID 956 wrote to memory of 1652	956	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
PID 956 wrote to memory of 1652	956	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
PID 1652 wrote to memory of 516	1652	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
PID 1652 wrote to memory of 516	1652	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
PID 1652 wrote to memory of 516	1652	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
PID 1652 wrote to memory of 516	1652	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
PID 1652 wrote to memory of 516	1652	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe	fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
PID 580 wrote to memory of 1296	580	watchedcounter.exe	watchedcounter.exe
PID 580 wrote to memory of 1296	580	watchedcounter.exe	watchedcounter.exe
PID 580 wrote to memory of 1296	580	watchedcounter.exe	watchedcounter.exe
PID 580 wrote to memory of 1296	580	watchedcounter.exe	watchedcounter.exe
PID 580 wrote to memory of 1296	580	watchedcounter.exe	watchedcounter.exe
PID 1296 wrote to memory of 856	1296	watchedcounter.exe	watchedcounter.exe
PID 1296 wrote to memory of 856	1296	watchedcounter.exe	watchedcounter.exe
PID 1296 wrote to memory of 856	1296	watchedcounter.exe	watchedcounter.exe
PID 1296 wrote to memory of 856	1296	watchedcounter.exe	watchedcounter.exe
PID 856 wrote to memory of 1072	856	watchedcounter.exe	watchedcounter.exe
PID 856 wrote to memory of 1072	856	watchedcounter.exe	watchedcounter.exe
PID 856 wrote to memory of 1072	856	watchedcounter.exe	watchedcounter.exe
PID 856 wrote to memory of 1072	856	watchedcounter.exe	watchedcounter.exe
PID 856 wrote to memory of 1072	856	watchedcounter.exe	watchedcounter.exe

C:\Users\Admin\AppData\Local\Temp\fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
"C:\Users\Admin\AppData\Local\Temp\fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008

C:\Users\Admin\AppData\Local\Temp\fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
"C:\Users\Admin\AppData\Local\Temp\fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:956

C:\Users\Admin\AppData\Local\Temp\fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
--a68cd9d0
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652

C:\Users\Admin\AppData\Local\Temp\fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f.exe
--a68cd9d0
4⤵
- Suspicious behavior: RenamesItself
PID:516

C:\Windows\SysWOW64\watchedcounter.exe
"C:\Windows\SysWOW64\watchedcounter.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:580

C:\Windows\SysWOW64\watchedcounter.exe
"C:\Windows\SysWOW64\watchedcounter.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1296

C:\Windows\SysWOW64\watchedcounter.exe
--8afb6840
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856

C:\Windows\SysWOW64\watchedcounter.exe
--8afb6840
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1072

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_5a633035-f6f6-46e5-abe0-a504cf633ef0
Filesize
1KB

MD5
f58d81d51fdfc64b5a355a444fa29003

SHA1
20a5be405abf70c5425e60cace93cd5416e264f4

SHA256
54edb8e335bcfac6dea1c2732ebab6045cf21193f40a9595f8e4df8d9e188916

SHA512
7385f7c33c6099882226d910105c53a3ab335976be84ed8fd48645d9f50a4fc2861959543ecb6d69da4c8b0750bbd80cb93c8c8480216c093f59241d73c6b535

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3406023954-474543476-3319432036-1000\0f5007522459c86e95ffcc62f32308f1_5a633035-f6f6-46e5-abe0-a504cf633ef0
Filesize
1KB

MD5
49b223f2714f79ecb263af00c91a62d2

SHA1
80a715336453672e3e81e057587a29099b4cc51a

SHA256
d1415362b5f7176067b7291a827c97148d3c64a41e5eac787e916c9e5df20fcc

SHA512
7e1a1b17852d62aed64a49860be1768bf9ba2d66b843896c83072b3d9b39c58643b9fc46a83223cf3609c0501e23d1f2c4407a2edbe66085cd72e500fd94ecf0

Download Submit
memory/516-67-0x000000000040D977-mapping.dmp

Download
memory/516-68-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/516-76-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/580-71-0x00000000003E0000-0x00000000003F4000-memory.dmp

Filesize
80KB

Download
memory/856-75-0x0000000000000000-mapping.dmp

Download
memory/956-58-0x000000000040D977-mapping.dmp

Download
memory/956-61-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1072-85-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1072-83-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1072-82-0x000000000040D977-mapping.dmp

Download
memory/1296-74-0x000000000040D977-mapping.dmp

Download
memory/1652-64-0x0000000000360000-0x0000000000374000-memory.dmp

Filesize
80KB

Download
memory/1652-60-0x0000000000000000-mapping.dmp

Download
memory/2008-54-0x00000000753D1000-0x00000000753D3000-memory.dmp

Filesize
8KB

Download
memory/2008-59-0x00000000002D0000-0x00000000002E3000-memory.dmp

Filesize
76KB

Download
memory/2008-55-0x0000000000350000-0x0000000000364000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads