emotet | d6d347e6a73691e86122c143754923b7bfeec9ffaf5c24406324457c1d547098

General

Target

4da2827ce3f839ec9553ed43f8d930fb.exe
Size

745KB
MD5

4da2827ce3f839ec9553ed43f8d930fb
SHA1

983e5f288040931bff241a9633889a7ba32a46d4
SHA256

d6d347e6a73691e86122c143754923b7bfeec9ffaf5c24406324457c1d547098
SHA512

ea3e7483e63ad730bad6897a19043f0e038c4eaa5a23ebac92bb1e3c7d7c1d65ccdbd1674bfa49df059c6fa884187311f7d7cc64a1908bcf68774c7cfec04ee7
SSDEEP

12288:P1iuahDbW+ePQKTguan8z/SbGvfqepaLPvzp8AxNyYVcdYn2ntlJ0i3lA:P1iuUXAQK8ulSbGvUntbyYVcdYoE

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

1.215.28.101:8080

184.167.148.162:80

66.25.34.20:80

165.227.156.155:443

167.99.105.223:7080

67.225.179.64:8080

176.31.200.130:8080

190.220.19.82:443

91.242.138.5:443

159.65.25.128:8080

61.197.110.214:80

110.143.84.202:80

95.128.43.213:8080

91.73.197.90:80

201.184.105.242:443

108.179.206.219:8080

181.57.193.14:80

188.152.7.140:80

139.130.241.252:443

197.254.221.174:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

rdschunker.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rdschunker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 24 IoCs

Processes:

rdschunker.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	rdschunker.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	rdschunker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	rdschunker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{77518CF5-450E-4149-B632-4B41780DAD57}\72-6b-7a-98-7e-15	rdschunker.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-6b-7a-98-7e-15\WpadDecisionReason = "1"	rdschunker.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-6b-7a-98-7e-15\WpadDecisionTime = a00d553bd542da01	rdschunker.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-6b-7a-98-7e-15\WpadDecision = "0"	rdschunker.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	rdschunker.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{77518CF5-450E-4149-B632-4B41780DAD57}\WpadDecisionReason = "1"	rdschunker.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{77518CF5-450E-4149-B632-4B41780DAD57}\WpadDecision = "0"	rdschunker.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{77518CF5-450E-4149-B632-4B41780DAD57}\WpadNetworkName = "Network 3"	rdschunker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rdschunker.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rdschunker.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	rdschunker.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rdschunker.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rdschunker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{77518CF5-450E-4149-B632-4B41780DAD57}	rdschunker.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{77518CF5-450E-4149-B632-4B41780DAD57}\WpadDecisionTime = a00d553bd542da01	rdschunker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rdschunker.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	rdschunker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	rdschunker.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rdschunker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	rdschunker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\72-6b-7a-98-7e-15	rdschunker.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

rdschunker.exe

pid process

2728 rdschunker.exe
2728 rdschunker.exe
2728 rdschunker.exe
2728 rdschunker.exe
2728 rdschunker.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

4da2827ce3f839ec9553ed43f8d930fb.exe

pid process

2664 4da2827ce3f839ec9553ed43f8d930fb.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

4da2827ce3f839ec9553ed43f8d930fb.exe4da2827ce3f839ec9553ed43f8d930fb.exerdschunker.exerdschunker.exe

pid process

1684 4da2827ce3f839ec9553ed43f8d930fb.exe
2664 4da2827ce3f839ec9553ed43f8d930fb.exe
2784 rdschunker.exe
2728 rdschunker.exe

pid	process
2728	rdschunker.exe
2728	rdschunker.exe
2728	rdschunker.exe
2728	rdschunker.exe
2728	rdschunker.exe

pid	process
2664	4da2827ce3f839ec9553ed43f8d930fb.exe

pid	process
1684	4da2827ce3f839ec9553ed43f8d930fb.exe
2664	4da2827ce3f839ec9553ed43f8d930fb.exe
2784	rdschunker.exe
2728	rdschunker.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

4da2827ce3f839ec9553ed43f8d930fb.exerdschunker.exe

description	pid	process	target process
PID 1684 wrote to memory of 2664	1684	4da2827ce3f839ec9553ed43f8d930fb.exe	4da2827ce3f839ec9553ed43f8d930fb.exe
PID 1684 wrote to memory of 2664	1684	4da2827ce3f839ec9553ed43f8d930fb.exe	4da2827ce3f839ec9553ed43f8d930fb.exe
PID 1684 wrote to memory of 2664	1684	4da2827ce3f839ec9553ed43f8d930fb.exe	4da2827ce3f839ec9553ed43f8d930fb.exe
PID 1684 wrote to memory of 2664	1684	4da2827ce3f839ec9553ed43f8d930fb.exe	4da2827ce3f839ec9553ed43f8d930fb.exe
PID 2784 wrote to memory of 2728	2784	rdschunker.exe	rdschunker.exe
PID 2784 wrote to memory of 2728	2784	rdschunker.exe	rdschunker.exe
PID 2784 wrote to memory of 2728	2784	rdschunker.exe	rdschunker.exe
PID 2784 wrote to memory of 2728	2784	rdschunker.exe	rdschunker.exe

C:\Users\Admin\AppData\Local\Temp\4da2827ce3f839ec9553ed43f8d930fb.exe
--c17c71e7
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2664

C:\Users\Admin\AppData\Local\Temp\4da2827ce3f839ec9553ed43f8d930fb.exe
"C:\Users\Admin\AppData\Local\Temp\4da2827ce3f839ec9553ed43f8d930fb.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\SysWOW64\rdschunker.exe
--50d4a28b
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2728

C:\Windows\SysWOW64\rdschunker.exe
"C:\Windows\SysWOW64\rdschunker.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-5-0x00000000001E0000-0x00000000001F1000-memory.dmp

Filesize
68KB

Download
memory/1684-0-0x0000000000200000-0x0000000000217000-memory.dmp

Filesize
92KB

Download
memory/2664-6-0x00000000002E0000-0x00000000002F7000-memory.dmp

Filesize
92KB

Download
memory/2728-16-0x00000000008F0000-0x0000000000907000-memory.dmp

Filesize
92KB

Download
memory/2784-11-0x00000000003C0000-0x00000000003D7000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads