emotet | ac6ff653497ef0da394e6485c2a29b584c602ae1fbed0a5327737e756045cc68

Analysis

max time kernel
133s
max time network
137s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
13/07/2024, 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d78e74e4a3f526cfa82930cd5a832971a36fdd22.exe
Size

540KB
MD5

807b153af73f3d659b64138be0e2f372
SHA1

d78e74e4a3f526cfa82930cd5a832971a36fdd22
SHA256

d26610e4560edbdcba6d4c93f9e9ded03103c036033838ef09c11daea9e305ca
SHA512

d1f2d628ac5b9b6374f1fbde6a8035c7ff7ddb977730c9383d6ca9b9ad10bf07170e6b243487ea4fc25d2690f8c889f8ebac96b18214c1f08b0919fd25b61fde
SSDEEP

12288:MoSmVo9Z2fg9Rq3Ezzm2I91lSbCge6sF3LW6zkp8q3wBCxoNFET75a5xoiZhnd35:YmCZ2j3f2Offge/9

Score

10^/10

emotet epoch3 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

190.117.206.153:443

203.99.187.137:443

200.55.168.82:20

70.32.94.58:8080

213.138.100.98:8080

144.76.62.10:8080

203.99.188.203:990

201.196.15.79:990

203.99.182.135:443

176.58.93.123:80

192.241.220.183:8080

94.177.253.126:80

181.47.235.26:993

216.75.37.196:8080

95.216.207.86:7080

78.109.34.178:443

113.52.135.33:7080

216.70.88.55:8080

138.197.140.163:8080

181.113.229.139:990

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	rebrandshlp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	rebrandshlp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	rebrandshlp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	rebrandshlp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	rebrandshlp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	rebrandshlp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rebrandshlp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	rebrandshlp.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
32	rebrandshlp.exe
32	rebrandshlp.exe
32	rebrandshlp.exe
32	rebrandshlp.exe
32	rebrandshlp.exe
32	rebrandshlp.exe
32	rebrandshlp.exe
32	rebrandshlp.exe
32	rebrandshlp.exe
32	rebrandshlp.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
656	d78e74e4a3f526cfa82930cd5a832971a36fdd22.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
712	d78e74e4a3f526cfa82930cd5a832971a36fdd22.exe
712	d78e74e4a3f526cfa82930cd5a832971a36fdd22.exe
656	d78e74e4a3f526cfa82930cd5a832971a36fdd22.exe
656	d78e74e4a3f526cfa82930cd5a832971a36fdd22.exe
3480	rebrandshlp.exe
3480	rebrandshlp.exe
32	rebrandshlp.exe
32	rebrandshlp.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 712 wrote to memory of 656	712	d78e74e4a3f526cfa82930cd5a832971a36fdd22.exe	72
PID 712 wrote to memory of 656	712	d78e74e4a3f526cfa82930cd5a832971a36fdd22.exe	72
PID 712 wrote to memory of 656	712	d78e74e4a3f526cfa82930cd5a832971a36fdd22.exe	72
PID 3480 wrote to memory of 32	3480	rebrandshlp.exe	74
PID 3480 wrote to memory of 32	3480	rebrandshlp.exe	74
PID 3480 wrote to memory of 32	3480	rebrandshlp.exe	74

C:\Users\Admin\AppData\Local\Temp\d78e74e4a3f526cfa82930cd5a832971a36fdd22.exe
"C:\Users\Admin\AppData\Local\Temp\d78e74e4a3f526cfa82930cd5a832971a36fdd22.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:712
- C:\Users\Admin\AppData\Local\Temp\d78e74e4a3f526cfa82930cd5a832971a36fdd22.exe
  --2c725f3e
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  PID:656

C:\Windows\SysWOW64\rebrandshlp.exe
"C:\Windows\SysWOW64\rebrandshlp.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\SysWOW64\rebrandshlp.exe
  --d31a0b03
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:32

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/32-17-0x0000000000D50000-0x0000000000D66000-memory.dmp

Filesize
88KB

Download
memory/656-6-0x0000000000640000-0x0000000000656000-memory.dmp

Filesize
88KB

Download
memory/656-16-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/712-5-0x0000000002340000-0x0000000002350000-memory.dmp

Filesize
64KB

Download
memory/712-0-0x0000000002360000-0x0000000002376000-memory.dmp

Filesize
88KB

Download
memory/3480-11-0x0000000000DF0000-0x0000000000E06000-memory.dmp

Filesize
88KB

Download