emotet | 045c4ab485bd45781234451af0eae62f23abceae375d5434cff37c3e5620f872

General

Target

f1ab1fa6d2b93ae55b448b96733ff195.exe
Size

477KB
MD5

f1ab1fa6d2b93ae55b448b96733ff195
SHA1

fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f
SHA256

045c4ab485bd45781234451af0eae62f23abceae375d5434cff37c3e5620f872
SHA512

06f5ebb1d2f1079bec579856cd676d256758961dabedc9851836ff22b6442c0efd9ec818b95715b8ee706e126df63322fd7e3ebe679e46bd91e49abb8caf5bd4
SSDEEP

12288:Ur1hcmamspxYUL24xYkPuPN1A27pNMTWdQpDx82540:IDdyxYUmA277MKwDlf

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

181.188.149.134:80

203.130.0.67:80

5.67.96.120:8080

189.245.135.12:143

143.0.245.169:8080

151.80.142.33:80

159.65.241.220:8080

109.104.79.48:8080

43.229.62.186:8080

72.47.248.48:8080

46.249.204.99:8080

181.48.174.242:80

190.230.60.129:80

89.188.124.145:443

187.242.204.142:80

200.57.102.71:8443

201.219.183.243:443

190.117.206.153:443

200.80.198.34:80

138.68.106.4:7080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

movemira.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	movemira.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

f1ab1fa6d2b93ae55b448b96733ff195.exef1ab1fa6d2b93ae55b448b96733ff195.exemovemira.exemovemira.exe

description	pid	process	target process
PID 1260 set thread context of 2020	1260	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 600 set thread context of 1340	600	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 1676 set thread context of 1896	1676	movemira.exe	movemira.exe
PID 284 set thread context of 992	284	movemira.exe	movemira.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

movemira.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	movemira.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	movemira.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40CF9792-CC47-4272-9DC7-8FA8AB75078F}\WpadDecisionReason = "1"	movemira.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40CF9792-CC47-4272-9DC7-8FA8AB75078F}\WpadDecisionTime = 70d826e0b637d901	movemira.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40CF9792-CC47-4272-9DC7-8FA8AB75078F}\WpadDecision = "0"	movemira.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	movemira.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	movemira.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40CF9792-CC47-4272-9DC7-8FA8AB75078F}	movemira.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40CF9792-CC47-4272-9DC7-8FA8AB75078F}\WpadNetworkName = "Network 2"	movemira.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-25-cc-86-ad-5e\WpadDecisionReason = "1"	movemira.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	movemira.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0051000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	movemira.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	movemira.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	movemira.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	movemira.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-25-cc-86-ad-5e	movemira.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	movemira.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	movemira.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-25-cc-86-ad-5e\WpadDecision = "0"	movemira.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40CF9792-CC47-4272-9DC7-8FA8AB75078F}\1e-25-cc-86-ad-5e	movemira.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-25-cc-86-ad-5e\WpadDecisionTime = 70d826e0b637d901	movemira.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

movemira.exe

pid process

992 movemira.exe
992 movemira.exe
992 movemira.exe
Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

f1ab1fa6d2b93ae55b448b96733ff195.exef1ab1fa6d2b93ae55b448b96733ff195.exemovemira.exemovemira.exe

pid process

1260 f1ab1fa6d2b93ae55b448b96733ff195.exe
600 f1ab1fa6d2b93ae55b448b96733ff195.exe
1676 movemira.exe
284 movemira.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

f1ab1fa6d2b93ae55b448b96733ff195.exe

pid process

1340 f1ab1fa6d2b93ae55b448b96733ff195.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

f1ab1fa6d2b93ae55b448b96733ff195.exef1ab1fa6d2b93ae55b448b96733ff195.exemovemira.exemovemira.exe

pid process

1260 f1ab1fa6d2b93ae55b448b96733ff195.exe
600 f1ab1fa6d2b93ae55b448b96733ff195.exe
1676 movemira.exe
284 movemira.exe

pid	process
992	movemira.exe
992	movemira.exe
992	movemira.exe

pid	process
1260	f1ab1fa6d2b93ae55b448b96733ff195.exe
600	f1ab1fa6d2b93ae55b448b96733ff195.exe
1676	movemira.exe
284	movemira.exe

pid	process
1340	f1ab1fa6d2b93ae55b448b96733ff195.exe

pid	process
1260	f1ab1fa6d2b93ae55b448b96733ff195.exe
600	f1ab1fa6d2b93ae55b448b96733ff195.exe
1676	movemira.exe
284	movemira.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

f1ab1fa6d2b93ae55b448b96733ff195.exef1ab1fa6d2b93ae55b448b96733ff195.exef1ab1fa6d2b93ae55b448b96733ff195.exemovemira.exemovemira.exemovemira.exe

description	pid	process	target process
PID 1260 wrote to memory of 2020	1260	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 1260 wrote to memory of 2020	1260	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 1260 wrote to memory of 2020	1260	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 1260 wrote to memory of 2020	1260	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 1260 wrote to memory of 2020	1260	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 2020 wrote to memory of 600	2020	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 2020 wrote to memory of 600	2020	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 2020 wrote to memory of 600	2020	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 2020 wrote to memory of 600	2020	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 600 wrote to memory of 1340	600	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 600 wrote to memory of 1340	600	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 600 wrote to memory of 1340	600	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 600 wrote to memory of 1340	600	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 600 wrote to memory of 1340	600	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 1676 wrote to memory of 1896	1676	movemira.exe	movemira.exe
PID 1676 wrote to memory of 1896	1676	movemira.exe	movemira.exe
PID 1676 wrote to memory of 1896	1676	movemira.exe	movemira.exe
PID 1676 wrote to memory of 1896	1676	movemira.exe	movemira.exe
PID 1676 wrote to memory of 1896	1676	movemira.exe	movemira.exe
PID 1896 wrote to memory of 284	1896	movemira.exe	movemira.exe
PID 1896 wrote to memory of 284	1896	movemira.exe	movemira.exe
PID 1896 wrote to memory of 284	1896	movemira.exe	movemira.exe
PID 1896 wrote to memory of 284	1896	movemira.exe	movemira.exe
PID 284 wrote to memory of 992	284	movemira.exe	movemira.exe
PID 284 wrote to memory of 992	284	movemira.exe	movemira.exe
PID 284 wrote to memory of 992	284	movemira.exe	movemira.exe
PID 284 wrote to memory of 992	284	movemira.exe	movemira.exe
PID 284 wrote to memory of 992	284	movemira.exe	movemira.exe

C:\Users\Admin\AppData\Local\Temp\f1ab1fa6d2b93ae55b448b96733ff195.exe
"C:\Users\Admin\AppData\Local\Temp\f1ab1fa6d2b93ae55b448b96733ff195.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260

C:\Users\Admin\AppData\Local\Temp\f1ab1fa6d2b93ae55b448b96733ff195.exe
"C:\Users\Admin\AppData\Local\Temp\f1ab1fa6d2b93ae55b448b96733ff195.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2020

C:\Users\Admin\AppData\Local\Temp\f1ab1fa6d2b93ae55b448b96733ff195.exe
--24ba2287
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:600

C:\Users\Admin\AppData\Local\Temp\f1ab1fa6d2b93ae55b448b96733ff195.exe
--24ba2287
4⤵
- Suspicious behavior: RenamesItself
PID:1340

C:\Windows\SysWOW64\movemira.exe
"C:\Windows\SysWOW64\movemira.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\movemira.exe
"C:\Windows\SysWOW64\movemira.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\SysWOW64\movemira.exe
--608eb66e
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:284

C:\Windows\SysWOW64\movemira.exe
--608eb66e
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:992

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_48ba80a0-b4f2-4449-9b22-a470b66c8a87
Filesize
1KB

MD5
8d4c9b46ec375b9d7474a2fcc78296f7

SHA1
4b1803914d083893d39c841ac5f5df87fb726fcf

SHA256
bd31ff0436ef08f296bad31cfb699a62a704fe376afb8666355c1140e0a0d52b

SHA512
0f0cc9f8f091ef973b2fc9abdee52328a329e477169109ff5a9ff5631e669d4ee18e391363a456c8d8e162e88c8e31e8292baf76ab20043c2cde9386686ed21d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1214520366-621468234-4062160515-1000\0f5007522459c86e95ffcc62f32308f1_48ba80a0-b4f2-4449-9b22-a470b66c8a87
Filesize
1KB

MD5
e34a45e9d28529b88ea9578a9f5d751a

SHA1
e4ede12f2b5a2d5f277a3a64e5203c3506f4aab3

SHA256
a85cdaa76ce9c65b11e0ba0e1035090e1985921ee2f517e7bb24f0ecc23a58d5

SHA512
6ee07a87710af5488e7331512f076393be4bed8c202c4282dc56a73abd07a9cd1f50c25534f77945da00fcf906d756e006fad3a5bdaa6858ab36c28f4f01fbdd

Download Submit
memory/284-75-0x0000000000000000-mapping.dmp

Download
memory/284-79-0x0000000000490000-0x00000000004A4000-memory.dmp

Filesize
80KB

Download
memory/600-60-0x0000000000000000-mapping.dmp

Download
memory/992-85-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/992-83-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/992-82-0x000000000040D977-mapping.dmp

Download
memory/1260-55-0x00000000003D0000-0x00000000003E4000-memory.dmp

Filesize
80KB

Download
memory/1260-59-0x0000000000250000-0x0000000000263000-memory.dmp

Filesize
76KB

Download
memory/1260-54-0x00000000753F1000-0x00000000753F3000-memory.dmp

Filesize
8KB

Download
memory/1340-68-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1340-76-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1340-67-0x000000000040D977-mapping.dmp

Download
memory/1676-71-0x0000000000A50000-0x0000000000A64000-memory.dmp

Filesize
80KB

Download
memory/1896-74-0x000000000040D977-mapping.dmp

Download
memory/2020-61-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2020-58-0x000000000040D977-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads