Overview

overview

10

Static

static

4c31883537...ab.exe

windows7_x64

10

4c31883537...ab.exe

windows10_x64

1

Analysis

  • max time kernel
    104s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    18-07-2020 05:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4c31883537991fbe64433f6becbfd072784862e10b2cc2e10dea59de3e1b01ab.exe

  • Size

    273KB

  • MD5

    40e29ef070e5cf9a87ecf9c51b842abf

  • SHA1

    8e06c3a39e71f38b73e7a20822997a428c5007e1

  • SHA256

    4c31883537991fbe64433f6becbfd072784862e10b2cc2e10dea59de3e1b01ab

  • SHA512

    fb5858771882e3d181beb0841d0e4b18ccb1f88b45de0f5305d1814afabe885bc70f7a751f175fd51760e7cf3e0c6b67df2131e27032357a507994ba6a1b4d9a

Score
10/10
trojanbankeremotet

Malware Config

Extracted

Family

emotet

C2

177.144.130.105:443

198.27.69.201:8080

157.7.164.178:8081

78.188.170.128:80

203.153.216.178:7080

77.74.78.80:443

178.33.167.120:8080

177.0.241.28:80

143.95.101.72:8080

51.38.201.19:7080

181.167.35.84:80

41.185.29.128:8080

192.163.221.191:8080

181.164.110.7:80

203.153.216.182:7080

80.211.32.88:8080

113.160.180.109:80

185.142.236.163:443

192.241.220.183:8080

87.106.231.60:8080
rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: EmotetMutantsSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4c31883537991fbe64433f6becbfd072784862e10b2cc2e10dea59de3e1b01ab.exe
    "C:\Users\Admin\AppData\Local\Temp\4c31883537991fbe64433f6becbfd072784862e10b2cc2e10dea59de3e1b01ab.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: EmotetMutantsSpam
    PID:1496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1496-0-0x0000000000280000-0x000000000028C000-memory.dmp
    Filesize

    48KB

    Download
  • memory/1496-1-0x0000000000400000-0x0000000000449000-memory.dmp
    Filesize

    292KB

    Download