emotet | baadf1748281d4ed2acc25d2f9571a711ae17ee1c7bc51a114852a74321b34c5

General

Target
2026-08-15_fcb2860eb4bf6dee9a13b282ed5bc5f0_elex_emotet_maze.exe
Size 68KB
Sample260815-rbbm6sysgs
SHA256 baadf1748281d4ed2acc25d2f9571a711ae17ee1c7bc51a114852a74321b34c5
MD5 fcb2860eb4bf6dee9a13b282ed5bc5f0
SHA1 2f12be1fdffc833b597995919e7bcdc0189f2c4e
SHA512 f3a354e773fe5bf9813fe6be799196a3ffb1c0616256fd80dbe87bf54137d48a7f08e360fd5b1ee0761ab7efbbba22bd435e304a48fc2a81a1ba3e7ec194657a
SSDEEP 1536:sE1SjujsC8XANkPZgJkM8Ydwqo0fdWoz5I9lKcfc6hxRGS+nN:zLjsXANkR/fkfdWolI9AiD6N
TLSH
T114639D17934FC07AF69340BE751BB5BF51283E391162A8DEFA87498968507E532E0F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker epoch2 discovery emotet trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

192.241.220.155:8080
167.99.105.223:7080
176.31.200.130:8080
212.129.24.79:8080
186.4.172.5:8080
200.51.94.251:80
86.22.221.170:80
190.211.207.11:443
5.196.74.210:8080
103.39.131.88:80
46.105.131.87:80
78.24.219.147:8080
186.4.172.5:443
133.167.80.63:7080
62.75.187.192:8080
104.131.11.150:8080
167.71.10.37:8080
190.145.67.134:8090
136.243.177.26:8080
181.143.53.227:21
94.205.247.10:80
192.81.213.192:8080
87.230.19.21:8080
86.150.70.135:80
189.209.217.49:80
169.239.182.217:8080
181.143.194.138:443
183.102.238.69:465
104.131.44.150:8080
173.249.47.77:8080
87.106.136.232:8080
27.147.163.188:8080
186.75.241.230:80
37.187.2.199:443
217.160.182.191:8080
59.103.164.174:80
206.189.98.125:8080
178.210.51.222:8080
47.41.213.2:22
149.202.153.252:8080
178.79.161.166:443
211.63.71.72:8080
212.71.234.16:8080
94.177.216.217:8080
173.212.203.26:8080
83.136.245.190:8080
104.236.246.93:8080
31.12.67.62:7080
190.228.72.244:53
200.71.148.138:8080
190.53.135.159:21
31.172.240.91:8080
85.104.59.244:20
45.33.49.124:443
138.201.140.110:8080
95.128.43.213:8080
152.89.236.214:8080
115.78.95.230:443
124.240.198.66:80
92.222.216.44:8080
91.205.215.66:8080
186.4.172.5:20
182.176.132.213:8090
37.157.194.134:443
209.141.41.136:8080
87.106.139.101:8080
80.11.163.139:21
144.139.247.220:80
159.65.25.128:8080
190.226.44.20:21

rsa_pubkey.plain

Signatures

Family: Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	engnetw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	engnetw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	engnetw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	engnetw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_fcb2860eb4bf6dee9a13b282ed5bc5f0_elex_emotet_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_fcb2860eb4bf6dee9a13b282ed5bc5f0_elex_emotet_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	engnetw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	engnetw.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	engnetw.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	engnetw.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	engnetw.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2972	engnetw.exe
2972	engnetw.exe
2972	engnetw.exe
2972	engnetw.exe
2972	engnetw.exe
2972	engnetw.exe
2972	engnetw.exe
2972	engnetw.exe
2972	engnetw.exe
2972	engnetw.exe
2972	engnetw.exe
2972	engnetw.exe
2972	engnetw.exe
2972	engnetw.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2948	2026-08-15_fcb2860eb4bf6dee9a13b282ed5bc5f0_elex_emotet_maze.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 2948	824	2026-08-15_fcb2860eb4bf6dee9a13b282ed5bc5f0_elex_emotet_maze.exe	87
PID 2408 wrote to memory of 2972	2408	engnetw.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-15_fcb2860eb4bf6dee9a13b282ed5bc5f0_elex_emotet_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_fcb2860eb4bf6dee9a13b282ed5bc5f0_elex_emotet_maze.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:824
- C:\Users\Admin\AppData\Local\Temp\2026-08-15_fcb2860eb4bf6dee9a13b282ed5bc5f0_elex_emotet_maze.exe
  --373659df
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  PID:2948

C:\Windows\SysWOW64\engnetw.exe
"C:\Windows\SysWOW64\engnetw.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\engnetw.exe
  --e8317f0e
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2948-0-0x0000000000180000-0x0000000000197000-memory.dmp

Download

Analysis

Sharing