emotet

General

Target

https://samples.vx-underground.org/Samples/Bazaar%20Collection/Downloadable%20Releases/Bazaar.2020.08.7z
Sample

240424-wcm5taeb8z

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

107.185.211.16:80

96.8.113.4:8080

153.126.210.205:7080

47.146.117.214:80

104.131.44.150:8080

169.239.182.217:8080

95.179.229.244:8080

209.182.216.177:443

209.141.54.221:8080

5.196.74.210:8080

72.12.127.184:443

104.131.11.150:443

200.55.243.138:8080

116.203.32.252:8080

142.105.151.124:443

81.2.235.111:8080

74.120.55.163:80

167.86.90.214:8080

87.106.139.101:8080

37.139.21.175:8080

rsa_pubkey.plain

Extracted

Family

remcos

Botnet

JULY-LOGS

C2

alhabib4rec.freeddns.org:2404

alhabib4rec.ddns.net:2404

alhabib4rec.duckdns.org:2404

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-5YOI67
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Extracted

Family

emotet

Botnet

Epoch1

C2

174.100.27.229:80

209.126.6.222:8080

5.153.250.14:8080

192.241.146.84:8080

95.9.180.128:80

77.55.211.77:8080

85.105.140.135:443

45.33.77.42:8080

77.90.136.129:8080

94.176.234.118:443

190.163.31.26:80

190.6.193.152:8080

190.181.235.46:80

81.198.69.61:80

188.2.217.94:80

114.109.179.60:80

83.169.21.32:7080

137.74.106.111:7080

212.231.60.98:80

170.81.48.2:80

rsa_pubkey.plain

Extracted

Family

emotet

Botnet

Epoch3

C2

162.249.220.190:80

85.25.207.108:8080

178.128.14.92:8080

181.113.229.139:443

118.70.15.19:8080

143.95.101.72:8080

139.99.157.213:8080

201.235.10.215:80

181.137.229.1:80

5.79.70.250:8080

107.161.30.122:8080

157.7.164.178:8081

87.106.231.60:8080

202.5.47.71:80

172.105.78.244:8080

177.94.227.143:80

173.94.215.84:80

181.126.54.234:80

217.199.160.224:8080

198.57.203.63:8080

rsa_pubkey.plain

Extracted

Family

nanocore

Version

1.2.2.0

C2

acokoye85.hopto.org:7600

185.140.53.15:7600

Mutex

e607a71c-ff71-46a0-b3d3-16215c82e9fd

Attributes

activate_away_mode
true
backup_connection_host
185.140.53.15
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-05-29T14:58:33.250638636Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
7600
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
e607a71c-ff71-46a0-b3d3-16215c82e9fd
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
acokoye85.hopto.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Targets

- Target
  
  https://samples.vx-underground.org/Samples/Bazaar%20Collection/Downloadable%20Releases/Bazaar.2020.08.7z
Score

10^/10

emotet nanocore ostap remcos epoch1 epoch2 epoch3 july-logs banker downloader evasion keylogger persistence rat spyware stealer trojan upx
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Ostap JavaScript downloader
  Ostap is a JavaScript downloader that's been active since 2016. It's used to deliver several families, inluding TrickBot
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- ostap
  Ostap is a JS downloader, used to deliver other families.
  downloader ostap
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1