emotet | 664649a3ecee62a83cbc77b16e4688b71b2237237da35c7af9d510491056fda3

General

Target

664649a3ecee62a83cbc77b16e4688b71b2237237da35c7af9d510491056fda3N.exe
Size

96KB
MD5

f7e551ec8acc6ad80cb032eedd4bb320
SHA1

cfb77e5b20076439239f3e39b39d95e551242d7c
SHA256

664649a3ecee62a83cbc77b16e4688b71b2237237da35c7af9d510491056fda3
SHA512

c9e2e8a9a3157ab9c2dd3d010b965739fe810615bf9b8138f0b6dc59e1892beed9f785039af2ff3fdf7108f11c07a52748700c8f46d74d6351628428951b21eb
SSDEEP

1536:bNfzLL8A7JVzj3f0ZxBwCqVTl6yfcACPEbUN9Ah:bNLLL8A7JVzj3AZqBNost

Score

10^/10

emotet epoch1 banker discovery trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

201.171.150.41:443

94.76.247.61:8080

213.176.36.147:8080

87.106.46.107:8080

209.236.123.42:8080

81.198.69.61:80

77.90.136.129:8080

177.73.0.98:443

190.6.193.152:8080

186.250.52.226:8080

217.13.106.14:8080

178.79.163.131:8080

188.2.217.94:80

51.255.165.160:8080

170.81.48.2:80

45.161.242.102:80

192.187.99.90:8080

187.162.248.237:80

192.241.146.84:8080

219.92.13.25:80

rsa_pubkey.plain

1
-----BEGIN PUBLIC KEY-----
2
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOZ9fLJ8UrI0OZURpPsR3eijAyfPj3z6
3
uS75f2igmYFW2aWgNcFIzsAYQleKzD0nlCFHOo7Zf8/4wY2UW0CJ4dJEHnE/PHlz
4
6uNk3pxjm7o4eCDyiJbzf+k0Azjl0q54FQIDAQAB
5
-----END PUBLIC KEY-----

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet

Emotet payload 3 IoCs

Detects Emotet payload in memory.

trojan banker

resource	yara_rule
behavioral1/memory/2376-4-0x00000000003A0000-0x00000000003A9000-memory.dmp	emotet
behavioral1/memory/2376-0-0x00000000003B0000-0x00000000003BC000-memory.dmp	emotet
behavioral1/memory/2376-5-0x00000000003B0000-0x00000000003BC000-memory.dmp	emotet

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	664649a3ecee62a83cbc77b16e4688b71b2237237da35c7af9d510491056fda3N.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2376	664649a3ecee62a83cbc77b16e4688b71b2237237da35c7af9d510491056fda3N.exe
2376	664649a3ecee62a83cbc77b16e4688b71b2237237da35c7af9d510491056fda3N.exe
2376	664649a3ecee62a83cbc77b16e4688b71b2237237da35c7af9d510491056fda3N.exe
2376	664649a3ecee62a83cbc77b16e4688b71b2237237da35c7af9d510491056fda3N.exe
2376	664649a3ecee62a83cbc77b16e4688b71b2237237da35c7af9d510491056fda3N.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2376	664649a3ecee62a83cbc77b16e4688b71b2237237da35c7af9d510491056fda3N.exe
2376	664649a3ecee62a83cbc77b16e4688b71b2237237da35c7af9d510491056fda3N.exe

C:\Users\Admin\AppData\Local\Temp\664649a3ecee62a83cbc77b16e4688b71b2237237da35c7af9d510491056fda3N.exe
"C:\Users\Admin\AppData\Local\Temp\664649a3ecee62a83cbc77b16e4688b71b2237237da35c7af9d510491056fda3N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2376

Network

POST

http://213.176.36.147:8080/DhVkupLPpQLw/

664649a3ecee62a83cbc77b16e4688b71b2237237da35c7af9d510491056fda3N.exe

Remote address:

213.176.36.147:8080

Request

POST /DhVkupLPpQLw/ HTTP/1.1
Referer: http://213.176.36.147/DhVkupLPpQLw/
Content-Type: multipart/form-data; boundary=---------------------------888398700037544
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: 213.176.36.147:8080
Content-Length: 4420
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 400 Bad Request

Server: WAF
Date: Sun, 24 Nov 2024 21:05:21 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Set-Cookie: waf_404=82f8a5cd-7fcd-4e3e-b70f-ac2d7c455de4; Max-Age=300; Path=/; HttpOnly
Cache-Control: no-cache, no-store
x-frame-options: sameorigin

201.171.150.41:443

664649a3ecee62a83cbc77b16e4688b71b2237237da35c7af9d510491056fda3N.exe

152 B
3
201.171.150.41:443

664649a3ecee62a83cbc77b16e4688b71b2237237da35c7af9d510491056fda3N.exe

152 B
3
94.76.247.61:8080

664649a3ecee62a83cbc77b16e4688b71b2237237da35c7af9d510491056fda3N.exe

152 B
3
94.76.247.61:8080

664649a3ecee62a83cbc77b16e4688b71b2237237da35c7af9d510491056fda3N.exe

152 B
3
213.176.36.147:8080

http://213.176.36.147:8080/DhVkupLPpQLw/

http

664649a3ecee62a83cbc77b16e4688b71b2237237da35c7af9d510491056fda3N.exe

5.3kB
692 B
9
7

HTTP Request

POST http://213.176.36.147:8080/DhVkupLPpQLw/

HTTP Response

400
87.106.46.107:8080

664649a3ecee62a83cbc77b16e4688b71b2237237da35c7af9d510491056fda3N.exe

152 B
3

No results found

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2376-4-0x00000000003A0000-0x00000000003A9000-memory.dmp

Filesize
36KB

Download
memory/2376-0-0x00000000003B0000-0x00000000003BC000-memory.dmp

Filesize
48KB

Download
memory/2376-5-0x00000000003B0000-0x00000000003BC000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

HTTP Request

HTTP Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.