emotet | 672d3e3a2dbecb8950cb8bd76c637fad98b59a3d27d1bf18fc327f40fa0948a3

Analysis

max time kernel
135s
max time network
148s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 00:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

E1-20200827_061516.exe
Size

412KB
MD5

054cfae95ec070930410ae76a38479a3
SHA1

da35bde84c40122582fd57d793b55f4062984822
SHA256

43c5bfbdf4f6627e2fd6de75977daa2dbf48e5cf0b42c7d0ad2cd921549b84f6
SHA512

8ff6467935aef47509622f9a169b6eaa71830fb7cf49613951376eff10353276f7196c163aad3c3ad75eeb3194bb4e94cb216002f8a2cc651998a3fb85949bc0
SSDEEP

3072:GzoB+F9ah8tFGNhd5/2dGqHNLiFgpaO8072SBKUgMFuNtaNm/xwa0+uw:G8B+F9Nuhd56paJEZTVu/Y+

Score

10^/10

emotet epoch1 banker discovery trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

71.197.211.156:80

87.118.70.45:8080

91.121.54.71:8080

116.125.120.88:443

213.60.96.117:80

188.2.217.94:80

174.100.27.229:80

46.28.111.142:7080

186.103.141.250:443

207.144.103.227:80

110.142.219.51:80

70.32.84.74:8080

70.32.115.157:8080

111.67.12.221:8080

219.92.13.25:80

149.62.173.247:8080

177.72.13.80:80

77.238.212.227:80

5.196.35.138:7080

114.109.179.60:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet
Executes dropped EXE 1 IoCs

Processes:

dtsh.exe

pid process

2484 dtsh.exe
Drops file in System32 directory 1 IoCs

Processes:

E1-20200827_061516.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\deskadp\dtsh.exe E1-20200827_061516.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2484	dtsh.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\deskadp\dtsh.exe	E1-20200827_061516.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

E1-20200827_061516.exedtsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E1-20200827_061516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dtsh.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

dtsh.exe

pid process

2484 dtsh.exe
2484 dtsh.exe
2484 dtsh.exe
2484 dtsh.exe
2484 dtsh.exe
2484 dtsh.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

E1-20200827_061516.exe

pid process

2824 E1-20200827_061516.exe

pid	process
2484	dtsh.exe
2484	dtsh.exe
2484	dtsh.exe
2484	dtsh.exe
2484	dtsh.exe
2484	dtsh.exe

pid	process
2824	E1-20200827_061516.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

E1-20200827_061516.exe

description	pid	process	target process
PID 2824 wrote to memory of 2484	2824	E1-20200827_061516.exe	dtsh.exe
PID 2824 wrote to memory of 2484	2824	E1-20200827_061516.exe	dtsh.exe
PID 2824 wrote to memory of 2484	2824	E1-20200827_061516.exe	dtsh.exe
PID 2824 wrote to memory of 2484	2824	E1-20200827_061516.exe	dtsh.exe

C:\Users\Admin\AppData\Local\Temp\E1-20200827_061516.exe
"C:\Users\Admin\AppData\Local\Temp\E1-20200827_061516.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\SysWOW64\deskadp\dtsh.exe
  "C:\Windows\SysWOW64\deskadp\dtsh.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\deskadp\dtsh.exe

Filesize
412KB

MD5
054cfae95ec070930410ae76a38479a3

SHA1
da35bde84c40122582fd57d793b55f4062984822

SHA256
43c5bfbdf4f6627e2fd6de75977daa2dbf48e5cf0b42c7d0ad2cd921549b84f6

SHA512
8ff6467935aef47509622f9a169b6eaa71830fb7cf49613951376eff10353276f7196c163aad3c3ad75eeb3194bb4e94cb216002f8a2cc651998a3fb85949bc0

Download Submit
memory/2484-7-0x00000000003D0000-0x00000000003DC000-memory.dmp

Filesize
48KB

Download
memory/2484-11-0x00000000003D0000-0x00000000003DC000-memory.dmp

Filesize
48KB

Download
memory/2824-0-0x0000000000240000-0x000000000024C000-memory.dmp

Filesize
48KB

Download
memory/2824-4-0x0000000000230000-0x0000000000239000-memory.dmp

Filesize
36KB

Download
memory/2824-6-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download