emotet | 045c4ab485bd45781234451af0eae62f23abceae375d5434cff37c3e5620f872

General

Target

f1ab1fa6d2b93ae55b448b96733ff195.exe
Size

477KB
MD5

f1ab1fa6d2b93ae55b448b96733ff195
SHA1

fa5c79321dd4cc2fea795d6ebe2e823abe33ca6f
SHA256

045c4ab485bd45781234451af0eae62f23abceae375d5434cff37c3e5620f872
SHA512

06f5ebb1d2f1079bec579856cd676d256758961dabedc9851836ff22b6442c0efd9ec818b95715b8ee706e126df63322fd7e3ebe679e46bd91e49abb8caf5bd4
SSDEEP

12288:Ur1hcmamspxYUL24xYkPuPN1A27pNMTWdQpDx82540:IDdyxYUmA277MKwDlf

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

181.188.149.134:80

203.130.0.67:80

5.67.96.120:8080

189.245.135.12:143

143.0.245.169:8080

151.80.142.33:80

159.65.241.220:8080

109.104.79.48:8080

43.229.62.186:8080

72.47.248.48:8080

46.249.204.99:8080

181.48.174.242:80

190.230.60.129:80

89.188.124.145:443

187.242.204.142:80

200.57.102.71:8443

201.219.183.243:443

190.117.206.153:443

200.80.198.34:80

138.68.106.4:7080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

xinputshell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	xinputshell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	xinputshell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	xinputshell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	xinputshell.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

f1ab1fa6d2b93ae55b448b96733ff195.exef1ab1fa6d2b93ae55b448b96733ff195.exexinputshell.exexinputshell.exe

description	pid	process	target process
PID 2324 set thread context of 1736	2324	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 2128 set thread context of 3896	2128	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 3980 set thread context of 2020	3980	xinputshell.exe	xinputshell.exe
PID 1912 set thread context of 3216	1912	xinputshell.exe	xinputshell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

xinputshell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	xinputshell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	xinputshell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	xinputshell.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

xinputshell.exe

pid	process
3216	xinputshell.exe
3216	xinputshell.exe
3216	xinputshell.exe
3216	xinputshell.exe
3216	xinputshell.exe
3216	xinputshell.exe
3216	xinputshell.exe
3216	xinputshell.exe
3216	xinputshell.exe
3216	xinputshell.exe
3216	xinputshell.exe
3216	xinputshell.exe
3216	xinputshell.exe
3216	xinputshell.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

f1ab1fa6d2b93ae55b448b96733ff195.exef1ab1fa6d2b93ae55b448b96733ff195.exexinputshell.exexinputshell.exe

pid process

2324 f1ab1fa6d2b93ae55b448b96733ff195.exe
2128 f1ab1fa6d2b93ae55b448b96733ff195.exe
3980 xinputshell.exe
1912 xinputshell.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

f1ab1fa6d2b93ae55b448b96733ff195.exe

pid process

3896 f1ab1fa6d2b93ae55b448b96733ff195.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

f1ab1fa6d2b93ae55b448b96733ff195.exef1ab1fa6d2b93ae55b448b96733ff195.exexinputshell.exexinputshell.exe

pid process

2324 f1ab1fa6d2b93ae55b448b96733ff195.exe
2128 f1ab1fa6d2b93ae55b448b96733ff195.exe
3980 xinputshell.exe
1912 xinputshell.exe

pid	process
2324	f1ab1fa6d2b93ae55b448b96733ff195.exe
2128	f1ab1fa6d2b93ae55b448b96733ff195.exe
3980	xinputshell.exe
1912	xinputshell.exe

pid	process
3896	f1ab1fa6d2b93ae55b448b96733ff195.exe

pid	process
2324	f1ab1fa6d2b93ae55b448b96733ff195.exe
2128	f1ab1fa6d2b93ae55b448b96733ff195.exe
3980	xinputshell.exe
1912	xinputshell.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

f1ab1fa6d2b93ae55b448b96733ff195.exef1ab1fa6d2b93ae55b448b96733ff195.exef1ab1fa6d2b93ae55b448b96733ff195.exexinputshell.exexinputshell.exexinputshell.exe

description	pid	process	target process
PID 2324 wrote to memory of 1736	2324	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 2324 wrote to memory of 1736	2324	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 2324 wrote to memory of 1736	2324	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 2324 wrote to memory of 1736	2324	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 1736 wrote to memory of 2128	1736	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 1736 wrote to memory of 2128	1736	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 1736 wrote to memory of 2128	1736	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 2128 wrote to memory of 3896	2128	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 2128 wrote to memory of 3896	2128	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 2128 wrote to memory of 3896	2128	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 2128 wrote to memory of 3896	2128	f1ab1fa6d2b93ae55b448b96733ff195.exe	f1ab1fa6d2b93ae55b448b96733ff195.exe
PID 3980 wrote to memory of 2020	3980	xinputshell.exe	xinputshell.exe
PID 3980 wrote to memory of 2020	3980	xinputshell.exe	xinputshell.exe
PID 3980 wrote to memory of 2020	3980	xinputshell.exe	xinputshell.exe
PID 3980 wrote to memory of 2020	3980	xinputshell.exe	xinputshell.exe
PID 2020 wrote to memory of 1912	2020	xinputshell.exe	xinputshell.exe
PID 2020 wrote to memory of 1912	2020	xinputshell.exe	xinputshell.exe
PID 2020 wrote to memory of 1912	2020	xinputshell.exe	xinputshell.exe
PID 1912 wrote to memory of 3216	1912	xinputshell.exe	xinputshell.exe
PID 1912 wrote to memory of 3216	1912	xinputshell.exe	xinputshell.exe
PID 1912 wrote to memory of 3216	1912	xinputshell.exe	xinputshell.exe
PID 1912 wrote to memory of 3216	1912	xinputshell.exe	xinputshell.exe

C:\Users\Admin\AppData\Local\Temp\f1ab1fa6d2b93ae55b448b96733ff195.exe
"C:\Users\Admin\AppData\Local\Temp\f1ab1fa6d2b93ae55b448b96733ff195.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324

C:\Users\Admin\AppData\Local\Temp\f1ab1fa6d2b93ae55b448b96733ff195.exe
"C:\Users\Admin\AppData\Local\Temp\f1ab1fa6d2b93ae55b448b96733ff195.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Users\Admin\AppData\Local\Temp\f1ab1fa6d2b93ae55b448b96733ff195.exe
--24ba2287
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128

C:\Users\Admin\AppData\Local\Temp\f1ab1fa6d2b93ae55b448b96733ff195.exe
--24ba2287
4⤵
- Suspicious behavior: RenamesItself
PID:3896

C:\Windows\SysWOW64\xinputshell.exe
"C:\Windows\SysWOW64\xinputshell.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3980

C:\Windows\SysWOW64\xinputshell.exe
"C:\Windows\SysWOW64\xinputshell.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\xinputshell.exe
--f478ac74
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\SysWOW64\xinputshell.exe
--f478ac74
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3216

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\a4ced0dab4942ac625af62d27fca6a5a_4cfb5922-b036-4c14-9ed1-03c0dad19fbd
Filesize
1KB

MD5
6e38ac0f087d9e47b3339702819deea7

SHA1
890b4f6e06e16d510b3d56d5b16599d56292587f

SHA256
b7c37fbe69b1f55f39ae6c8ef9b4394bc4db5dd4763c97530cfbee86b03eb826

SHA512
fea7e4072ca0acbf27b15c605aebd16d1b5e1bdc5d1441a7da9b996eb865d91fd026a3cc19fcbc82763788a614ab76c6162b141eec2f612085cc96396090eb31

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-929662420-1054238289-2961194603-1000\0f5007522459c86e95ffcc62f32308f1_4cfb5922-b036-4c14-9ed1-03c0dad19fbd
Filesize
1KB

MD5
674a6b45fbb1c7e47019c071d13593b4

SHA1
189aa82fa67510841754e81e8bc58168b75849db

SHA256
e4585f80fbfd8a3780a98584ff761da608437a37c70844bd28a36cfbb28259d8

SHA512
4bb748a784a42aeec09ba09b050238a82eadb5b923944e826307dd21ac854e3146dc631ae89c5ece082f8410d9e7f6aca8ff4655b396238e691905b20d506bf0

Download Submit
memory/1736-135-0x0000000000000000-mapping.dmp

Download
memory/1736-137-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1912-152-0x0000000000E30000-0x0000000000E44000-memory.dmp

Filesize
80KB

Download
memory/1912-149-0x0000000000000000-mapping.dmp

Download
memory/2020-148-0x0000000000000000-mapping.dmp

Download
memory/2128-140-0x0000000002170000-0x0000000002184000-memory.dmp

Filesize
80KB

Download
memory/2128-136-0x0000000000000000-mapping.dmp

Download
memory/2324-132-0x0000000000810000-0x0000000000824000-memory.dmp

Filesize
80KB

Download
memory/2324-138-0x0000000000640000-0x0000000000653000-memory.dmp

Filesize
76KB

Download
memory/3216-156-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3216-157-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3216-155-0x0000000000000000-mapping.dmp

Download
memory/3896-144-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3896-150-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3896-143-0x0000000000000000-mapping.dmp

Download
memory/3980-145-0x0000000000E40000-0x0000000000E54000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads