emotet | 934cecf8e3c6cb783c0618b9ebe980fda93d630eec67386362f689efc6ca8d4c

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19cef7562887e33b0325cd3b20906c87.exe
Size

578KB
MD5

19cef7562887e33b0325cd3b20906c87
SHA1

fffb2257ac5ba63707e4d0f6aab20e6544a33dcb
SHA256

934cecf8e3c6cb783c0618b9ebe980fda93d630eec67386362f689efc6ca8d4c
SHA512

dd5e379bcb50443ce5556d224c54ea1fc1c79ff2fd4cce124363aad9f5c7e0d3f50533c32ef8c4871f218a634bc1e669a9ab7a343e17fc4e05d82be0e61366a3
SSDEEP

12288:weR8tZORi7suUDGoqRq7nPwNQvOINPA+Mmd:p2fOpxq08NAOIV13

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

212.71.234.16:8080

78.47.106.72:8080

165.227.156.155:443

192.241.255.77:8080

149.202.153.252:8080

144.139.247.220:80

159.65.25.128:8080

211.63.71.72:8080

45.33.49.124:443

186.4.172.5:20

179.12.170.148:8080

103.39.131.88:80

190.53.135.159:21

37.157.194.134:443

181.31.213.158:8080

104.239.175.211:8080

85.104.59.244:20

80.11.163.139:21

176.31.200.130:8080

217.160.182.191:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

noniplk.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	noniplk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	noniplk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	noniplk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	noniplk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

noniplk.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	noniplk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	noniplk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	noniplk.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

noniplk.exe

pid	process
4980	noniplk.exe
4980	noniplk.exe
4980	noniplk.exe
4980	noniplk.exe
4980	noniplk.exe
4980	noniplk.exe
4980	noniplk.exe
4980	noniplk.exe
4980	noniplk.exe
4980	noniplk.exe
4980	noniplk.exe
4980	noniplk.exe
4980	noniplk.exe
4980	noniplk.exe
4980	noniplk.exe
4980	noniplk.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

19cef7562887e33b0325cd3b20906c87.exe

pid process

2248 19cef7562887e33b0325cd3b20906c87.exe

pid	process
2248	19cef7562887e33b0325cd3b20906c87.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

19cef7562887e33b0325cd3b20906c87.exenoniplk.exe

description	pid	process	target process
PID 1680 wrote to memory of 2248	1680	19cef7562887e33b0325cd3b20906c87.exe	19cef7562887e33b0325cd3b20906c87.exe
PID 1680 wrote to memory of 2248	1680	19cef7562887e33b0325cd3b20906c87.exe	19cef7562887e33b0325cd3b20906c87.exe
PID 1680 wrote to memory of 2248	1680	19cef7562887e33b0325cd3b20906c87.exe	19cef7562887e33b0325cd3b20906c87.exe
PID 5020 wrote to memory of 4980	5020	noniplk.exe	noniplk.exe
PID 5020 wrote to memory of 4980	5020	noniplk.exe	noniplk.exe
PID 5020 wrote to memory of 4980	5020	noniplk.exe	noniplk.exe

C:\Users\Admin\AppData\Local\Temp\19cef7562887e33b0325cd3b20906c87.exe
"C:\Users\Admin\AppData\Local\Temp\19cef7562887e33b0325cd3b20906c87.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1680

C:\Users\Admin\AppData\Local\Temp\19cef7562887e33b0325cd3b20906c87.exe
--1bb4e8f9
2⤵
- Suspicious behavior: RenamesItself
PID:2248

C:\Windows\SysWOW64\noniplk.exe
"C:\Windows\SysWOW64\noniplk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5020

C:\Windows\SysWOW64\noniplk.exe
--1ea3f5a9
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4980

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\2361ef17363918abd6e411d250262bac_54015c33-dfb0-46c4-86c9-75a4c12545c1
Filesize
50B

MD5
83b38bf58bffa836dd5e392c9f42a332

SHA1
9aab4d82867fe53448edc28d41106ad8747d4800

SHA256
2019716119a817c7a626e7a9f426ad04111bd7a97af76ae0c34d6b80d7250ea3

SHA512
de40b42a5a22dd08223d10b034685c7a4f760c5a818e68c55f8713ca1261356012bdfc8935e9920aa0e676e2ca83e1bbc7706f6651cd7d658e4ddba7e69e0444

Download Submit
memory/1680-5-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1680-6-0x0000000000760000-0x0000000000770000-memory.dmp

Filesize
64KB

Download
memory/1680-0-0x0000000000770000-0x0000000000785000-memory.dmp

Filesize
84KB

Download
memory/2248-7-0x00000000009C0000-0x00000000009D5000-memory.dmp

Filesize
84KB

Download
memory/4980-20-0x00000000016E0000-0x00000000016F5000-memory.dmp

Filesize
84KB

Download
memory/4980-25-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/5020-13-0x0000000000800000-0x0000000000815000-memory.dmp

Filesize
84KB

Download
memory/5020-18-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download