emotet | d6d347e6a73691e86122c143754923b7bfeec9ffaf5c24406324457c1d547098

General

Target

4da2827ce3f839ec9553ed43f8d930fb.exe
Size

745KB
MD5

4da2827ce3f839ec9553ed43f8d930fb
SHA1

983e5f288040931bff241a9633889a7ba32a46d4
SHA256

d6d347e6a73691e86122c143754923b7bfeec9ffaf5c24406324457c1d547098
SHA512

ea3e7483e63ad730bad6897a19043f0e038c4eaa5a23ebac92bb1e3c7d7c1d65ccdbd1674bfa49df059c6fa884187311f7d7cc64a1908bcf68774c7cfec04ee7
SSDEEP

12288:P1iuahDbW+ePQKTguan8z/SbGvfqepaLPvzp8AxNyYVcdYn2ntlJ0i3lA:P1iuUXAQK8ulSbGvUntbyYVcdYoE

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

1.215.28.101:8080

184.167.148.162:80

66.25.34.20:80

165.227.156.155:443

167.99.105.223:7080

67.225.179.64:8080

176.31.200.130:8080

190.220.19.82:443

91.242.138.5:443

159.65.25.128:8080

61.197.110.214:80

110.143.84.202:80

95.128.43.213:8080

91.73.197.90:80

201.184.105.242:443

108.179.206.219:8080

181.57.193.14:80

188.152.7.140:80

139.130.241.252:443

197.254.221.174:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

Processes:

grouppublish.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	grouppublish.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	grouppublish.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	grouppublish.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	grouppublish.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 8 IoCs

Processes:

grouppublish.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	grouppublish.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	grouppublish.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	grouppublish.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	grouppublish.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	grouppublish.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	grouppublish.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	grouppublish.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	grouppublish.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

grouppublish.exe

pid	process
4680	grouppublish.exe
4680	grouppublish.exe
4680	grouppublish.exe
4680	grouppublish.exe
4680	grouppublish.exe
4680	grouppublish.exe
4680	grouppublish.exe
4680	grouppublish.exe
4680	grouppublish.exe
4680	grouppublish.exe
4680	grouppublish.exe
4680	grouppublish.exe
4680	grouppublish.exe
4680	grouppublish.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

4da2827ce3f839ec9553ed43f8d930fb.exe

pid process

2004 4da2827ce3f839ec9553ed43f8d930fb.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

4da2827ce3f839ec9553ed43f8d930fb.exe4da2827ce3f839ec9553ed43f8d930fb.exegrouppublish.exegrouppublish.exe

pid process

4944 4da2827ce3f839ec9553ed43f8d930fb.exe
2004 4da2827ce3f839ec9553ed43f8d930fb.exe
2556 grouppublish.exe
4680 grouppublish.exe

pid	process
2004	4da2827ce3f839ec9553ed43f8d930fb.exe

pid	process
4944	4da2827ce3f839ec9553ed43f8d930fb.exe
2004	4da2827ce3f839ec9553ed43f8d930fb.exe
2556	grouppublish.exe
4680	grouppublish.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

4da2827ce3f839ec9553ed43f8d930fb.exegrouppublish.exe

description	pid	process	target process
PID 4944 wrote to memory of 2004	4944	4da2827ce3f839ec9553ed43f8d930fb.exe	4da2827ce3f839ec9553ed43f8d930fb.exe
PID 4944 wrote to memory of 2004	4944	4da2827ce3f839ec9553ed43f8d930fb.exe	4da2827ce3f839ec9553ed43f8d930fb.exe
PID 4944 wrote to memory of 2004	4944	4da2827ce3f839ec9553ed43f8d930fb.exe	4da2827ce3f839ec9553ed43f8d930fb.exe
PID 2556 wrote to memory of 4680	2556	grouppublish.exe	grouppublish.exe
PID 2556 wrote to memory of 4680	2556	grouppublish.exe	grouppublish.exe
PID 2556 wrote to memory of 4680	2556	grouppublish.exe	grouppublish.exe

C:\Users\Admin\AppData\Local\Temp\4da2827ce3f839ec9553ed43f8d930fb.exe
"C:\Users\Admin\AppData\Local\Temp\4da2827ce3f839ec9553ed43f8d930fb.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4944

C:\Users\Admin\AppData\Local\Temp\4da2827ce3f839ec9553ed43f8d930fb.exe
--c17c71e7
2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2004

C:\Windows\SysWOW64\grouppublish.exe
"C:\Windows\SysWOW64\grouppublish.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556

C:\Windows\SysWOW64\grouppublish.exe
--340ec782
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4680

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2004-6-0x0000000002130000-0x0000000002147000-memory.dmp

Filesize
92KB

Download
memory/2556-11-0x0000000000EA0000-0x0000000000EB7000-memory.dmp

Filesize
92KB

Download
memory/4680-16-0x0000000000DF0000-0x0000000000E07000-memory.dmp

Filesize
92KB

Download
memory/4944-5-0x0000000002240000-0x0000000002251000-memory.dmp

Filesize
68KB

Download
memory/4944-0-0x0000000002270000-0x0000000002287000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads