Analysis

  • max time kernel
    17s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    09-09-2020 17:31

General

  • Target

    E1.bin.exe

  • Size

    608KB

  • MD5

    854b2fc809ee3432366f0a3ebad48f9f

  • SHA1

    c0fa1cdbd8412635b4ea1753895fc0dda0af95a4

  • SHA256

    bdef76fad180d81d1ac91576c1dd44423a64c836db08c5e985282ab7b55ace01

  • SHA512

    add3c3cfffbcc386fa0116afefc1cc7fbcde5479e3dd1b10b79afc01b7a75d8a2b8ee180ca1fbcd6aa50d23b78d04a5afecb535a29636e84d934708efb871ee5

Score
10/10

Malware Config

Extracted

Family

emotet

C2

74.136.144.133:80

51.38.124.206:80

178.79.163.131:8080

82.196.15.205:8080

212.71.237.140:8080

67.247.242.247:80

87.106.46.107:8080

104.131.103.37:8080

83.169.21.32:7080

45.161.242.102:80

110.142.219.51:80

45.173.88.33:80

187.162.248.237:80

5.196.35.138:7080

72.47.248.48:7080

186.103.141.250:443

98.13.75.196:80

77.90.136.129:8080

186.70.127.199:8090

152.169.22.67:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Suspicious behavior: EnumeratesProcesses ⋅ 2 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\E1.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\E1.bin.exe"
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of SetWindowsHookEx
    PID:1100

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

            Execution

              Exfiltration

                Impact

                  Initial Access

                    Lateral Movement

                      Persistence

                        Privilege Escalation

                          Replay Monitor

                          00:00 00:00

                          Downloads

                          • memory/1100-0-0x0000000000240000-0x0000000000252000-memory.dmp
                          • memory/1100-1-0x0000000000380000-0x0000000000390000-memory.dmp
                          • memory/1580-2-0x000007FEF7D20000-0x000007FEF7F9A000-memory.dmp