emotet | 7c017123bdcb32ece3624c846e7262f9b9cd04ce4e8608e5f3d02448ea9c1bbc

General

Target

eba98abe00f0a411e6736cf916d05c70.exe
Size

572KB
MD5

eba98abe00f0a411e6736cf916d05c70
SHA1

fba38ef52ce7f582ffa8582dafc7517b310c396b
SHA256

7c017123bdcb32ece3624c846e7262f9b9cd04ce4e8608e5f3d02448ea9c1bbc
SHA512

1df1c131751fb709778c61e3de005ea295661fbf9556ff0c90659fdba62b129c7b758bc7fea14e3705c178fbe9641f8ac5ce7fb56eae43533dde11d2e5db4cc7
SSDEEP

6144:hLOYXpa/ummNl/C5lXS/U6zJjSOd77yPZ5qxSorTCQ2z07517k0bbS9ZuXCBnS91:h6ummjiX6B+PZC+OByZJS9rVFN

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

2.38.99.79:80

98.24.231.64:80

47.156.70.145:80

37.59.24.177:8080

66.34.201.20:7080

108.179.206.219:8080

45.56.88.91:443

206.189.112.148:8080

120.150.246.241:80

190.56.255.118:80

200.71.148.138:8080

192.241.255.77:8080

211.63.71.72:8080

190.53.135.159:21

183.102.238.69:465

108.191.2.72:80

107.170.24.125:8080

167.114.242.226:8080

91.73.197.90:80

178.209.71.63:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

scanmalert.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	scanmalert.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

scanmalert.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	scanmalert.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	scanmalert.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	scanmalert.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	scanmalert.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	scanmalert.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	scanmalert.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C7E7326-C2AC-40C8-B3F5-4EB6B0A8D363}	scanmalert.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C7E7326-C2AC-40C8-B3F5-4EB6B0A8D363}\WpadDecision = "0"	scanmalert.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-9e-dd-ac-b5-86\WpadDecisionTime = 10d7a8fc2e36da01	scanmalert.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	scanmalert.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C7E7326-C2AC-40C8-B3F5-4EB6B0A8D363}\3e-9e-dd-ac-b5-86	scanmalert.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00cc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	scanmalert.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	scanmalert.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	scanmalert.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C7E7326-C2AC-40C8-B3F5-4EB6B0A8D363}\WpadDecisionReason = "1"	scanmalert.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C7E7326-C2AC-40C8-B3F5-4EB6B0A8D363}\WpadDecisionTime = 10d7a8fc2e36da01	scanmalert.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2C7E7326-C2AC-40C8-B3F5-4EB6B0A8D363}\WpadNetworkName = "Network 3"	scanmalert.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-9e-dd-ac-b5-86	scanmalert.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-9e-dd-ac-b5-86\WpadDecisionReason = "1"	scanmalert.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	scanmalert.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3e-9e-dd-ac-b5-86\WpadDecision = "0"	scanmalert.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

scanmalert.exe

pid process

2860 scanmalert.exe
2860 scanmalert.exe
2860 scanmalert.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

eba98abe00f0a411e6736cf916d05c70.exe

pid process

2296 eba98abe00f0a411e6736cf916d05c70.exe

pid	process
2860	scanmalert.exe
2860	scanmalert.exe
2860	scanmalert.exe

pid	process
2296	eba98abe00f0a411e6736cf916d05c70.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

eba98abe00f0a411e6736cf916d05c70.exeeba98abe00f0a411e6736cf916d05c70.exescanmalert.exescanmalert.exe

pid	process
2756	eba98abe00f0a411e6736cf916d05c70.exe
2756	eba98abe00f0a411e6736cf916d05c70.exe
2296	eba98abe00f0a411e6736cf916d05c70.exe
2296	eba98abe00f0a411e6736cf916d05c70.exe
2724	scanmalert.exe
2724	scanmalert.exe
2860	scanmalert.exe
2860	scanmalert.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

eba98abe00f0a411e6736cf916d05c70.exescanmalert.exe

description	pid	process	target process
PID 2756 wrote to memory of 2296	2756	eba98abe00f0a411e6736cf916d05c70.exe	eba98abe00f0a411e6736cf916d05c70.exe
PID 2756 wrote to memory of 2296	2756	eba98abe00f0a411e6736cf916d05c70.exe	eba98abe00f0a411e6736cf916d05c70.exe
PID 2756 wrote to memory of 2296	2756	eba98abe00f0a411e6736cf916d05c70.exe	eba98abe00f0a411e6736cf916d05c70.exe
PID 2756 wrote to memory of 2296	2756	eba98abe00f0a411e6736cf916d05c70.exe	eba98abe00f0a411e6736cf916d05c70.exe
PID 2724 wrote to memory of 2860	2724	scanmalert.exe	scanmalert.exe
PID 2724 wrote to memory of 2860	2724	scanmalert.exe	scanmalert.exe
PID 2724 wrote to memory of 2860	2724	scanmalert.exe	scanmalert.exe
PID 2724 wrote to memory of 2860	2724	scanmalert.exe	scanmalert.exe

C:\Users\Admin\AppData\Local\Temp\eba98abe00f0a411e6736cf916d05c70.exe
"C:\Users\Admin\AppData\Local\Temp\eba98abe00f0a411e6736cf916d05c70.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756

C:\Users\Admin\AppData\Local\Temp\eba98abe00f0a411e6736cf916d05c70.exe
--9927d7e7
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2296

C:\Windows\SysWOW64\scanmalert.exe
"C:\Windows\SysWOW64\scanmalert.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724

C:\Windows\SysWOW64\scanmalert.exe
--c910d2be
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2860

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2296-6-0x0000000000380000-0x0000000000397000-memory.dmp

Filesize
92KB

Download
memory/2724-11-0x0000000000610000-0x0000000000627000-memory.dmp

Filesize
92KB

Download
memory/2756-0-0x0000000000390000-0x00000000003A7000-memory.dmp

Filesize
92KB

Download
memory/2756-4-0x00000000002E0000-0x00000000002F1000-memory.dmp

Filesize
68KB

Download
memory/2860-16-0x0000000000630000-0x0000000000647000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads