Overview

overview

10

Static

static

YeFr3B8HGmT.exe

windows7_x64

10

YeFr3B8HGmT.exe

windows10_x64

10

Analysis

  • max time kernel
    52s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    07/08/2020, 07:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    YeFr3B8HGmT.exe
  • Size 156KB
  • Sample200807-18sp4fphn2
  • SHA256 9451b9bef367fea68cf60907bf0edf4c99a3a242000f6e8b85b8772954c16af3
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Family

  • emotet

C2

  • 47.146.32.175:80

  • 212.51.142.238:8080

  • 200.55.243.138:8080

  • 114.146.222.200:80

  • 153.126.210.205:7080

  • 121.124.124.40:7080

  • 222.214.218.37:4143

  • 67.241.24.163:8080

  • 180.92.239.110:8080

  • 203.153.216.189:7080

  • 119.198.40.179:80

  • 70.167.215.250:8080

  • 168.235.67.138:7080

  • 190.55.181.54:443

  • 139.59.60.244:8080

  • 189.212.199.126:443

  • 78.24.219.147:8080

  • 61.19.246.238:443

  • 137.59.187.107:8080

  • 87.106.139.101:8080

rsa_pubkey.plain

Signatures

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Emotet Payload 2 IoCs

    Detects Emotet payload in memory.

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

Processes

  • C:\Users\Admin\AppData\Local\Temp\YeFr3B8HGmT.exe
    "C:\Users\Admin\AppData\Local\Temp\YeFr3B8HGmT.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious behavior: EnumeratesProcesses
    PID:1100

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1100-0-0x00000000003F0000-0x00000000003FC000-memory.dmp
        Download

        memory/1400-1-0x000007FEF7D20000-0x000007FEF7F9A000-memory.dmp
        Download