emotet | ac6ff653497ef0da394e6485c2a29b584c602ae1fbed0a5327737e756045cc68

Analysis

max time kernel
145s
max time network
155s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
13/07/2024, 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3f7f7bbc77c46786b1c2be629a30c50c440bfd0.exe
Size

376KB
MD5

29eedff928b3aa34d5098bedc14290cf
SHA1

b3f7f7bbc77c46786b1c2be629a30c50c440bfd0
SHA256

a4532a333319600efa847ac6b63b58e855838df70063ceeb58d605f81d223922
SHA512

458268173b5778d418c787d344e6c61ef9e26ba67f9b7164fe8b58fc73c9376fe227568d9ebea2763b55509ead86134fb6511af9cadc9a904c02fb9d5a3f9a90
SSDEEP

3072:QIY6F26ww3+BllLiOC7S7NsZOd3ENvLh+7gRhX5SKg9HUZqacfj533uTO6t:TYleOOxaUNjh8Kg90wpF+TO

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

186.75.241.230:80

181.143.194.138:443

181.143.53.227:21

85.104.59.244:20

80.11.163.139:443

167.71.10.37:8080

104.131.44.150:8080

185.187.198.15:80

133.167.80.63:7080

198.199.114.69:8080

144.139.247.220:80

152.89.236.214:8080

78.24.219.147:8080

92.222.216.44:8080

46.105.131.87:80

190.226.44.20:21

182.176.132.213:8090

85.54.169.141:8080

192.81.213.192:8080

101.187.237.217:20

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	cplssms.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	cplssms.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	cplssms.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	cplssms.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	cplssms.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	cplssms.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	cplssms.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	cplssms.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4140	cplssms.exe
4140	cplssms.exe
4140	cplssms.exe
4140	cplssms.exe
4140	cplssms.exe
4140	cplssms.exe
4140	cplssms.exe
4140	cplssms.exe
4140	cplssms.exe
4140	cplssms.exe
4140	cplssms.exe
4140	cplssms.exe
4140	cplssms.exe
4140	cplssms.exe
4140	cplssms.exe
4140	cplssms.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3116	b3f7f7bbc77c46786b1c2be629a30c50c440bfd0.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 3116	4180	b3f7f7bbc77c46786b1c2be629a30c50c440bfd0.exe	73
PID 4180 wrote to memory of 3116	4180	b3f7f7bbc77c46786b1c2be629a30c50c440bfd0.exe	73
PID 4180 wrote to memory of 3116	4180	b3f7f7bbc77c46786b1c2be629a30c50c440bfd0.exe	73
PID 4308 wrote to memory of 4140	4308	cplssms.exe	75
PID 4308 wrote to memory of 4140	4308	cplssms.exe	75
PID 4308 wrote to memory of 4140	4308	cplssms.exe	75

C:\Users\Admin\AppData\Local\Temp\b3f7f7bbc77c46786b1c2be629a30c50c440bfd0.exe
"C:\Users\Admin\AppData\Local\Temp\b3f7f7bbc77c46786b1c2be629a30c50c440bfd0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Users\Admin\AppData\Local\Temp\b3f7f7bbc77c46786b1c2be629a30c50c440bfd0.exe
  --57e763d
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3116

C:\Windows\SysWOW64\cplssms.exe
"C:\Windows\SysWOW64\cplssms.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\SysWOW64\cplssms.exe
  --d7f77d9b
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3116-6-0x00000000004C0000-0x00000000004D4000-memory.dmp

Filesize
80KB

Download
memory/3116-16-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/4180-5-0x00000000001F0000-0x00000000001FF000-memory.dmp

Filesize
60KB

Download
memory/4180-0-0x00000000004F0000-0x0000000000504000-memory.dmp

Filesize
80KB

Download
memory/4308-11-0x00000000005C0000-0x00000000005D4000-memory.dmp

Filesize
80KB

Download