emotet | 38d866238c27c2f20ea4ef039757b6c4d0d569b4ece9c56b57cd264a60665141

Analysis

max time kernel
145s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-02-2024 22:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-22_cb62ddb2f261e5ad34e24ceb5d384fb1_icedid.exe
Size

424KB
MD5

cb62ddb2f261e5ad34e24ceb5d384fb1
SHA1

c6c3185c5968731b18e150ef35ad4ccf05ac3752
SHA256

38d866238c27c2f20ea4ef039757b6c4d0d569b4ece9c56b57cd264a60665141
SHA512

53aa461864fada21ce434fdde5d258017a15a2020a4f72f0d19c3901523e2f44e19247ec78c5eda541408a3605bea78b09eaf7ec91fc4a9d3033e16a0223f9b2
SSDEEP

6144:4abhDkzV+z3ItUUiCFYcK/7X0XfGkDmrDI3Z4KFzq+EP78YaAy2+1Oo:4YhozVKIixT7XFPc3CixEP7Z

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

12.163.208.58:80

45.33.35.74:8080

87.106.253.248:8080

192.241.146.84:8080

190.115.18.139:8080

65.36.62.20:80

170.81.48.2:80

83.169.21.32:7080

185.232.182.218:80

190.2.31.172:80

77.106.157.34:8080

82.230.1.24:80

202.4.58.197:80

201.213.177.139:80

78.249.119.122:80

123.51.47.18:80

77.90.136.129:8080

60.93.23.51:80

152.169.22.67:80

190.117.79.209:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet payload 5 IoCs

Detects Emotet payload in memory.

trojan banker

Processes:

resource	yara_rule
behavioral1/memory/2244-0-0x0000000000230000-0x0000000000242000-memory.dmp	emotet
behavioral1/memory/2244-2-0x0000000000220000-0x000000000022F000-memory.dmp	emotet
behavioral1/memory/2244-5-0x0000000000250000-0x0000000000260000-memory.dmp	emotet
behavioral1/memory/2440-9-0x00000000002C0000-0x00000000002D2000-memory.dmp	emotet
behavioral1/memory/2440-13-0x00000000002E0000-0x00000000002F0000-memory.dmp	emotet

Executes dropped EXE 1 IoCs

Processes:

cscdll.exe

pid process

2440 cscdll.exe
Drops file in System32 directory 1 IoCs

Processes:

2024-02-22_cb62ddb2f261e5ad34e24ceb5d384fb1_icedid.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\INETRES\cscdll.exe 2024-02-22_cb62ddb2f261e5ad34e24ceb5d384fb1_icedid.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

cscdll.exe

pid process

2440 cscdll.exe
2440 cscdll.exe
2440 cscdll.exe
2440 cscdll.exe
2440 cscdll.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

2024-02-22_cb62ddb2f261e5ad34e24ceb5d384fb1_icedid.exe

pid process

2244 2024-02-22_cb62ddb2f261e5ad34e24ceb5d384fb1_icedid.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2024-02-22_cb62ddb2f261e5ad34e24ceb5d384fb1_icedid.execscdll.exe

pid process

2244 2024-02-22_cb62ddb2f261e5ad34e24ceb5d384fb1_icedid.exe
2440 cscdll.exe

pid	process
2440	cscdll.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\INETRES\cscdll.exe	2024-02-22_cb62ddb2f261e5ad34e24ceb5d384fb1_icedid.exe

pid	process
2440	cscdll.exe
2440	cscdll.exe
2440	cscdll.exe
2440	cscdll.exe
2440	cscdll.exe

pid	process
2244	2024-02-22_cb62ddb2f261e5ad34e24ceb5d384fb1_icedid.exe

pid	process
2244	2024-02-22_cb62ddb2f261e5ad34e24ceb5d384fb1_icedid.exe
2440	cscdll.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-02-22_cb62ddb2f261e5ad34e24ceb5d384fb1_icedid.exe

description	pid	process	target process
PID 2244 wrote to memory of 2440	2244	2024-02-22_cb62ddb2f261e5ad34e24ceb5d384fb1_icedid.exe	cscdll.exe
PID 2244 wrote to memory of 2440	2244	2024-02-22_cb62ddb2f261e5ad34e24ceb5d384fb1_icedid.exe	cscdll.exe
PID 2244 wrote to memory of 2440	2244	2024-02-22_cb62ddb2f261e5ad34e24ceb5d384fb1_icedid.exe	cscdll.exe
PID 2244 wrote to memory of 2440	2244	2024-02-22_cb62ddb2f261e5ad34e24ceb5d384fb1_icedid.exe	cscdll.exe

C:\Users\Admin\AppData\Local\Temp\2024-02-22_cb62ddb2f261e5ad34e24ceb5d384fb1_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-22_cb62ddb2f261e5ad34e24ceb5d384fb1_icedid.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244

C:\Windows\SysWOW64\INETRES\cscdll.exe
"C:\Windows\SysWOW64\INETRES\cscdll.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2440

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\INETRES\cscdll.exe
Filesize
424KB

MD5
cb62ddb2f261e5ad34e24ceb5d384fb1

SHA1
c6c3185c5968731b18e150ef35ad4ccf05ac3752

SHA256
38d866238c27c2f20ea4ef039757b6c4d0d569b4ece9c56b57cd264a60665141

SHA512
53aa461864fada21ce434fdde5d258017a15a2020a4f72f0d19c3901523e2f44e19247ec78c5eda541408a3605bea78b09eaf7ec91fc4a9d3033e16a0223f9b2

Download Submit
memory/2244-0-0x0000000000230000-0x0000000000242000-memory.dmp

Filesize
72KB

Download
memory/2244-2-0x0000000000220000-0x000000000022F000-memory.dmp

Filesize
60KB

Download
memory/2244-5-0x0000000000250000-0x0000000000260000-memory.dmp

Filesize
64KB

Download
memory/2440-9-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/2440-13-0x00000000002E0000-0x00000000002F0000-memory.dmp

Filesize
64KB

Download