emotet | 934cecf8e3c6cb783c0618b9ebe980fda93d630eec67386362f689efc6ca8d4c

General

Target

19cef7562887e33b0325cd3b20906c87.exe
Size

578KB
MD5

19cef7562887e33b0325cd3b20906c87
SHA1

fffb2257ac5ba63707e4d0f6aab20e6544a33dcb
SHA256

934cecf8e3c6cb783c0618b9ebe980fda93d630eec67386362f689efc6ca8d4c
SHA512

dd5e379bcb50443ce5556d224c54ea1fc1c79ff2fd4cce124363aad9f5c7e0d3f50533c32ef8c4871f218a634bc1e669a9ab7a343e17fc4e05d82be0e61366a3
SSDEEP

12288:weR8tZORi7suUDGoqRq7nPwNQvOINPA+Mmd:p2fOpxq08NAOIV13

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

212.71.234.16:8080

78.47.106.72:8080

165.227.156.155:443

192.241.255.77:8080

149.202.153.252:8080

144.139.247.220:80

159.65.25.128:8080

211.63.71.72:8080

45.33.49.124:443

186.4.172.5:20

179.12.170.148:8080

103.39.131.88:80

190.53.135.159:21

37.157.194.134:443

181.31.213.158:8080

104.239.175.211:8080

85.104.59.244:20

80.11.163.139:21

176.31.200.130:8080

217.160.182.191:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

charprints.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	charprints.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 25 IoCs

Processes:

charprints.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	charprints.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	charprints.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-9c-c3-b9-bf-74\WpadDecisionTime = 103dd64c663eda01	charprints.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	charprints.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{39C0FDC6-44CD-4B4E-9B0E-FD4F9AF2BDB9}\WpadDecisionTime = b004b515663eda01	charprints.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{39C0FDC6-44CD-4B4E-9B0E-FD4F9AF2BDB9}\WpadDecisionReason = "1"	charprints.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{39C0FDC6-44CD-4B4E-9B0E-FD4F9AF2BDB9}\WpadDecision = "0"	charprints.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-9c-c3-b9-bf-74\WpadDetectedUrl	charprints.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{39C0FDC6-44CD-4B4E-9B0E-FD4F9AF2BDB9}\WpadDecisionTime = 103dd64c663eda01	charprints.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	charprints.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	charprints.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	charprints.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	charprints.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{39C0FDC6-44CD-4B4E-9B0E-FD4F9AF2BDB9}\fa-9c-c3-b9-bf-74	charprints.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{39C0FDC6-44CD-4B4E-9B0E-FD4F9AF2BDB9}\WpadNetworkName = "Network 3"	charprints.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	charprints.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0094000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	charprints.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-9c-c3-b9-bf-74	charprints.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0094000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	charprints.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	charprints.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{39C0FDC6-44CD-4B4E-9B0E-FD4F9AF2BDB9}	charprints.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-9c-c3-b9-bf-74\WpadDecisionReason = "1"	charprints.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	charprints.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-9c-c3-b9-bf-74\WpadDecisionTime = b004b515663eda01	charprints.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-9c-c3-b9-bf-74\WpadDecision = "0"	charprints.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

charprints.exe

pid process

2880 charprints.exe
2880 charprints.exe
2880 charprints.exe
2880 charprints.exe
2880 charprints.exe
2880 charprints.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

19cef7562887e33b0325cd3b20906c87.exe

pid process

1736 19cef7562887e33b0325cd3b20906c87.exe

pid	process
2880	charprints.exe
2880	charprints.exe
2880	charprints.exe
2880	charprints.exe
2880	charprints.exe
2880	charprints.exe

pid	process
1736	19cef7562887e33b0325cd3b20906c87.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

19cef7562887e33b0325cd3b20906c87.execharprints.exe

description	pid	process	target process
PID 2932 wrote to memory of 1736	2932	19cef7562887e33b0325cd3b20906c87.exe	19cef7562887e33b0325cd3b20906c87.exe
PID 2932 wrote to memory of 1736	2932	19cef7562887e33b0325cd3b20906c87.exe	19cef7562887e33b0325cd3b20906c87.exe
PID 2932 wrote to memory of 1736	2932	19cef7562887e33b0325cd3b20906c87.exe	19cef7562887e33b0325cd3b20906c87.exe
PID 2932 wrote to memory of 1736	2932	19cef7562887e33b0325cd3b20906c87.exe	19cef7562887e33b0325cd3b20906c87.exe
PID 2380 wrote to memory of 2880	2380	charprints.exe	charprints.exe
PID 2380 wrote to memory of 2880	2380	charprints.exe	charprints.exe
PID 2380 wrote to memory of 2880	2380	charprints.exe	charprints.exe
PID 2380 wrote to memory of 2880	2380	charprints.exe	charprints.exe

C:\Users\Admin\AppData\Local\Temp\19cef7562887e33b0325cd3b20906c87.exe
"C:\Users\Admin\AppData\Local\Temp\19cef7562887e33b0325cd3b20906c87.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2932

C:\Users\Admin\AppData\Local\Temp\19cef7562887e33b0325cd3b20906c87.exe
--1bb4e8f9
2⤵
- Suspicious behavior: RenamesItself
PID:1736

C:\Windows\SysWOW64\charprints.exe
"C:\Windows\SysWOW64\charprints.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2380

C:\Windows\SysWOW64\charprints.exe
--d98dfb6e
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2880

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2380-12-0x00000000004A0000-0x00000000004B5000-memory.dmp

Filesize
84KB

Download
memory/2380-17-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2880-18-0x00000000003D0000-0x00000000003E5000-memory.dmp

Filesize
84KB

Download
memory/2880-23-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2932-1-0x0000000000360000-0x0000000000370000-memory.dmp

Filesize
64KB

Download
memory/2932-0-0x0000000000370000-0x0000000000385000-memory.dmp

Filesize
84KB

Download
memory/2932-6-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads