emotet | 6a391f2287a31da8391d6eba6f36eac2c35c86a9f3cc01e905bd986f48275fcc

Analysis

max time kernel
46s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03-04-2024 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6TYwBEsuS3j14dCM.exe
Size

318KB
MD5

4a77d07c69aab90716bda7e5fdc02409
SHA1

d9bf0be971efc8136cdcb06c48ad59530de7d22c
SHA256

065e6e0ac102dda862b7f3301e0975be468877ae269779def89af5bcf4a6f605
SHA512

16fb7380682c7913c8fe69f3cb3ed76e08a7871a7bdf15d6fab334f3ab14c3ba26b8e5c505c4f18751ee2d5b48f7cddd5c28f9dd719a0f686d5894141fe64e20
SSDEEP

6144:9U39yixK0dkI6ukU1EqlhVLLiLLwLL5ZbgiUPbY:4rxRdbDHTC3P

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

50.121.220.50:80

51.75.33.122:80

54.37.42.48:8080

91.121.54.71:8080

45.16.226.117:443

68.69.155.181:80

213.60.96.117:80

77.55.211.77:8080

152.169.22.67:80

110.142.219.51:80

2.47.112.152:80

206.15.68.237:443

217.13.106.14:8080

191.99.160.58:80

189.131.57.131:80

213.197.182.158:8080

94.176.234.118:443

61.92.159.208:8080

190.128.173.10:80

219.92.8.17:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Executes dropped EXE 1 IoCs

Processes:

msvcp110.exe

pid process

2328 msvcp110.exe
Drops file in System32 directory 1 IoCs

Processes:

6TYwBEsuS3j14dCM.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\networkexplorer\msvcp110.exe 6TYwBEsuS3j14dCM.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msvcp110.exe

pid process

2328 msvcp110.exe
2328 msvcp110.exe
2328 msvcp110.exe
2328 msvcp110.exe
2328 msvcp110.exe
2328 msvcp110.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

6TYwBEsuS3j14dCM.exe

pid process

4976 6TYwBEsuS3j14dCM.exe

pid	process
2328	msvcp110.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\networkexplorer\msvcp110.exe	6TYwBEsuS3j14dCM.exe

pid	process
2328	msvcp110.exe
2328	msvcp110.exe
2328	msvcp110.exe
2328	msvcp110.exe
2328	msvcp110.exe
2328	msvcp110.exe

pid	process
4976	6TYwBEsuS3j14dCM.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

6TYwBEsuS3j14dCM.exe

description	pid	process	target process
PID 4976 wrote to memory of 2328	4976	6TYwBEsuS3j14dCM.exe	msvcp110.exe
PID 4976 wrote to memory of 2328	4976	6TYwBEsuS3j14dCM.exe	msvcp110.exe
PID 4976 wrote to memory of 2328	4976	6TYwBEsuS3j14dCM.exe	msvcp110.exe

C:\Users\Admin\AppData\Local\Temp\6TYwBEsuS3j14dCM.exe
"C:\Users\Admin\AppData\Local\Temp\6TYwBEsuS3j14dCM.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4976

C:\Windows\SysWOW64\networkexplorer\msvcp110.exe
"C:\Windows\SysWOW64\networkexplorer\msvcp110.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2328

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2196

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\networkexplorer\msvcp110.exe
Filesize
318KB

MD5
4a77d07c69aab90716bda7e5fdc02409

SHA1
d9bf0be971efc8136cdcb06c48ad59530de7d22c

SHA256
065e6e0ac102dda862b7f3301e0975be468877ae269779def89af5bcf4a6f605

SHA512
16fb7380682c7913c8fe69f3cb3ed76e08a7871a7bdf15d6fab334f3ab14c3ba26b8e5c505c4f18751ee2d5b48f7cddd5c28f9dd719a0f686d5894141fe64e20

Download Submit
memory/2328-6-0x0000000000710000-0x000000000071C000-memory.dmp

Filesize
48KB

Download
memory/2328-10-0x0000000000710000-0x000000000071C000-memory.dmp

Filesize
48KB

Download
memory/2328-11-0x00000000020C0000-0x00000000020F2000-memory.dmp

Filesize
200KB

Download
memory/4976-0-0x0000000001400000-0x000000000140C000-memory.dmp

Filesize
48KB

Download
memory/4976-1-0x00000000013F0000-0x00000000013F9000-memory.dmp

Filesize
36KB

Download