emotet | ac6ff653497ef0da394e6485c2a29b584c602ae1fbed0a5327737e756045cc68

Analysis

max time kernel
140s
max time network
156s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
13/07/2024, 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Size

487KB
MD5

2d1b923443d456cde45559a15a2c59fa
SHA1

f164297bfae27da0440ccd0cb81fdb48fdcaa0de
SHA256

72bf2eb295e2b41ce57c07aca7b4bb2721116a47c74fd119beff3a7e04820a18
SHA512

b58a131949028bfd0298a2a69ef897eaaefda21f4e5094dda7cd903c40886dea5fd917214830c3f1ddc81546d62f9721e72dca0b4ce9355cc47e9fda3cd62d3b
SSDEEP

6144:rTj57Z0Lnr0s1pWxD14XLN9JpFAeSeDXrJl3PvgJ6zU5hfQCGw6QpTDj3E8ExGl:ZPs/WIXLHJp2VYXrJ5PvfUv33E8Ao

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

186.75.241.230:80

181.143.194.138:443

181.143.53.227:21

85.104.59.244:20

80.11.163.139:443

104.131.44.150:8080

185.187.198.15:80

133.167.80.63:7080

198.199.114.69:8080

192.254.173.31:8080

182.76.6.2:8080

85.106.1.166:50000

59.103.164.174:80

182.176.106.43:995

92.233.128.13:143

149.202.153.252:8080

206.189.98.125:8080

190.108.228.48:990

190.226.44.20:21

85.54.169.141:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	prepminimum.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	prepminimum.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	prepminimum.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	prepminimum.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	prepminimum.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	prepminimum.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	prepminimum.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	prepminimum.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon\ = "C:\\Windows\\SysWOW64\\PREPMI~1.EXE,0"	prepminimum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command	prepminimum.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command\ = "C:\\Windows\\SysWOW64\\PREPMI~1.EXE /dde"	prepminimum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\F16429~1.EXE /dde"	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ = "Recalc.Document.1"	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command\ = "C:\\Windows\\SysWOW64\\PREPMI~1.EXE /dde"	prepminimum.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\F16429~1.EXE,0"	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL	prepminimum.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\F16429~1.EXE /dde"	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\F16429~1.EXE /dde"	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec	prepminimum.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew\NullFile	prepminimum.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\ = "Recalc Document"	prepminimum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\F16429~1.EXE /dde"	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]"	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1	prepminimum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon	prepminimum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec	prepminimum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command	prepminimum.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec\ = "[open(\"%1\")]"	prepminimum.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]"	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]"	prepminimum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1	prepminimum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec	prepminimum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew	prepminimum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec	prepminimum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew\NullFile	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew	prepminimum.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\ = "Recalc Document"	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec\ = "[open(\"%1\")]"	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ = "Recalc.Document.1"	prepminimum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec	prepminimum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]"	prepminimum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command	prepminimum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	prepminimum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command	prepminimum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command	prepminimum.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\F16429~1.EXE,0"	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command\ = "C:\\Windows\\SysWOW64\\PREPMI~1.EXE /dde"	prepminimum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon	prepminimum.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command\ = "C:\\Windows\\SysWOW64\\PREPMI~1.EXE /dde"	prepminimum.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4200	prepminimum.exe
4200	prepminimum.exe
4200	prepminimum.exe
4200	prepminimum.exe
4200	prepminimum.exe
4200	prepminimum.exe
4200	prepminimum.exe
4200	prepminimum.exe
4200	prepminimum.exe
4200	prepminimum.exe
4200	prepminimum.exe
4200	prepminimum.exe
4200	prepminimum.exe
4200	prepminimum.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4612	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4520	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
4520	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
4612	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
4612	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
164	prepminimum.exe
164	prepminimum.exe
4200	prepminimum.exe
4200	prepminimum.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 4612	4520	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe	73
PID 4520 wrote to memory of 4612	4520	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe	73
PID 4520 wrote to memory of 4612	4520	f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe	73
PID 164 wrote to memory of 4200	164	prepminimum.exe	75
PID 164 wrote to memory of 4200	164	prepminimum.exe	75
PID 164 wrote to memory of 4200	164	prepminimum.exe	75

C:\Users\Admin\AppData\Local\Temp\f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
"C:\Users\Admin\AppData\Local\Temp\f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Users\Admin\AppData\Local\Temp\f164297bfae27da0440ccd0cb81fdb48fdcaa0de.exe
  --db629943
  2⤵
  - Modifies registry class
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  PID:4612

C:\Windows\SysWOW64\prepminimum.exe
"C:\Windows\SysWOW64\prepminimum.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:164
- C:\Windows\SysWOW64\prepminimum.exe
  --b0d6f5d7
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/164-11-0x0000000000E20000-0x0000000000E34000-memory.dmp

Filesize
80KB

Download
memory/4200-17-0x0000000000CA0000-0x0000000000CB4000-memory.dmp

Filesize
80KB

Download
memory/4520-0-0x0000000002300000-0x0000000002314000-memory.dmp

Filesize
80KB

Download
memory/4520-5-0x00000000006C0000-0x00000000006CF000-memory.dmp

Filesize
60KB

Download
memory/4612-6-0x00000000021D0000-0x00000000021E4000-memory.dmp

Filesize
80KB

Download
memory/4612-16-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download