emotet | b1cad1540ecb290088252635f8e130022eed7486eb128c0ca3d676945d60a9fc

Resubmissions

17/07/2023, 13:37

230717-qwxkpscc39 10

14/07/2023, 23:18

230714-299mzahc7t 10

Analysis

max time kernel
183s
max time network
197s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
17/07/2023, 13:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

267.bin.exe
Size

384KB
MD5

f3f48c57c38bff2ddd220f20569e1ee6
SHA1

0421127f1bcca91a6ab2a570a47f8159101b751a
SHA256

b1cad1540ecb290088252635f8e130022eed7486eb128c0ca3d676945d60a9fc
SHA512

4e6432ef57936317341b7b81ec433100d37bf46e84513e4fb495a2f820201af54d4f24f19e04d1f80aa03fd6662a1740303929ec2741b771523fb18ce87ed545
SSDEEP

3072:iYyIxN7LMWf+GPBLi21ocO2jytUkU4uDQUiysA+30Sor6KH7j0m43ayYZt:GIx5MKQUJkqDDj+xW6KH7IuN

Score

10^/10

emotet epoch3 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

190.117.206.153:443

203.99.187.137:443

200.55.168.82:20

70.32.94.58:8080

213.138.100.98:8080

144.76.62.10:8080

203.99.188.203:990

201.196.15.79:990

203.99.182.135:443

176.58.93.123:80

192.241.220.183:8080

94.177.253.126:80

181.47.235.26:993

216.75.37.196:8080

95.216.207.86:7080

78.109.34.178:443

113.52.135.33:7080

216.70.88.55:8080

138.197.140.163:8080

181.113.229.139:990

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	prepsizes.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	prepsizes.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	prepsizes.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	prepsizes.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	prepsizes.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	prepsizes.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	prepsizes.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	prepsizes.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe
612	prepsizes.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4456	267.bin.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 4456	3964	267.bin.exe	70
PID 3964 wrote to memory of 4456	3964	267.bin.exe	70
PID 3964 wrote to memory of 4456	3964	267.bin.exe	70
PID 1068 wrote to memory of 612	1068	prepsizes.exe	72
PID 1068 wrote to memory of 612	1068	prepsizes.exe	72
PID 1068 wrote to memory of 612	1068	prepsizes.exe	72

C:\Users\Admin\AppData\Local\Temp\267.bin.exe
"C:\Users\Admin\AppData\Local\Temp\267.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Users\Admin\AppData\Local\Temp\267.bin.exe
  --1fcea4b0
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4456

C:\Windows\SysWOW64\prepsizes.exe
"C:\Windows\SysWOW64\prepsizes.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\SysWOW64\prepsizes.exe
  --1826b53b
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/612-136-0x00000000005E0000-0x00000000005F6000-memory.dmp

Filesize
88KB

Download
memory/1068-131-0x0000000000510000-0x0000000000526000-memory.dmp

Filesize
88KB

Download
memory/3964-121-0x00000000004B0000-0x00000000004C6000-memory.dmp

Filesize
88KB

Download
memory/3964-120-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/4456-126-0x00000000005D0000-0x00000000005E6000-memory.dmp

Filesize
88KB

Download