Triage | Behavioral Report

Analysis

max time kernel
132s
max time network
137s
platform
windows7_x64
resource
win7
submitted
09-09-2020 17:32

Sharing

Report Files Registry Network Processes Mutex Misc

General

Target

E2.bin.exe
Size

608KB
MD5

b4b4e2489e8d2bf539e08b7df7d34128
SHA1

46d3f03752809c6f5abf66f17d8562beb60451af
SHA256

37db086d928b34c1f967cfc26b56c48df99d6024be493345880af15f21a453a2
SHA512

d6765bc3ad13e6dac4f22bdae8d27dfcff27dd8cfb33b46820f958e5f8c566439919d9b56d36a50d1c333ad46fe1a9492ef52d049fc94d070344a71cef99c2ab

Score

10^/10

trojan banker emotet

Malware Config

Extracted

Family	emotet
C2	50.91.114.38:80 120.138.30.150:8080 139.59.67.118:443 94.23.216.33:80 107.5.122.110:80 95.213.236.64:8080 84.39.182.7:80 47.144.21.12:443 200.114.213.233:8080 176.111.60.55:8080 70.180.43.7:80 121.124.124.40:7080 113.160.130.116:8443 103.86.49.11:8080 85.105.205.77:8080 174.102.48.180:443 37.187.72.193:8080 189.212.199.126:443 85.152.162.105:80 104.236.246.93:8080 5.39.91.110:7080 24.137.76.62:80 70.121.172.89:80 24.43.99.75:80 139.99.158.11:443 203.153.216.189:7080 89.205.113.80:80 79.98.24.39:8080 82.80.155.43:80 201.173.217.124:443 75.139.38.211:80 173.62.217.22:443 120.150.60.189:80 61.19.246.238:443 174.45.13.118:80 68.188.112.97:80 74.120.55.163:80 62.30.7.67:443 97.82.79.83:80 162.241.242.173:8080 219.74.18.66:443 99.224.14.125:80 46.105.131.79:8080 137.119.36.33:80 203.117.253.142:80 83.169.36.251:8080 187.161.206.24:80 94.200.114.161:80 139.130.242.43:80 74.208.45.104:8080 137.59.187.107:8080 185.94.252.104:443 94.23.237.171:443 87.106.136.232:8080 172.91.208.86:80 216.208.76.186:80 79.137.83.50:443 168.235.67.138:7080 91.211.88.52:7080 109.74.5.95:8080 85.214.28.226:8080 104.131.44.150:8080 139.162.108.71:8080 104.131.11.150:443 209.141.54.221:8080 67.205.85.243:8080 62.75.141.82:80 24.179.13.119:80 190.160.53.126:80 194.187.133.160:443 188.219.31.12:80 93.147.212.206:80 37.139.21.175:8080 169.239.182.217:8080 112.185.64.233:80 153.232.188.106:80 110.145.77.103:80 1.221.254.82:80 95.179.229.244:8080 87.106.139.101:8080 192.158.216.73:80 139.59.60.244:8080 200.41.121.90:80 85.66.181.138:80 78.24.219.147:8080 5.196.74.210:8080 157.245.99.39:8080 190.55.181.54:443 50.91.114.38:80 120.138.30.150:8080 139.59.67.118:443 94.23.216.33:80 107.5.122.110:80 95.213.236.64:8080 84.39.182.7:80 47.144.21.12:443 200.114.213.233:8080 176.111.60.55:8080 70.180.43.7:80 121.124.124.40:7080 113.160.130.116:8443 103.86.49.11:8080 85.105.205.77:8080 174.102.48.180:443 37.187.72.193:8080 189.212.199.126:443 85.152.162.105:80 104.236.246.93:8080 5.39.91.110:7080 24.137.76.62:80 70.121.172.89:80 24.43.99.75:80 139.99.158.11:443 203.153.216.189:7080 89.205.113.80:80 79.98.24.39:8080 82.80.155.43:80 201.173.217.124:443 75.139.38.211:80 173.62.217.22:443 120.150.60.189:80 61.19.246.238:443 174.45.13.118:80 68.188.112.97:80 74.120.55.163:80 62.30.7.67:443 97.82.79.83:80 162.241.242.173:8080 219.74.18.66:443 99.224.14.125:80 46.105.131.79:8080 137.119.36.33:80 203.117.253.142:80 83.169.36.251:8080 187.161.206.24:80 94.200.114.161:80 139.130.242.43:80 74.208.45.104:8080 137.59.187.107:8080 185.94.252.104:443 94.23.237.171:443 87.106.136.232:8080 172.91.208.86:80 216.208.76.186:80 79.137.83.50:443 168.235.67.138:7080 91.211.88.52:7080 109.74.5.95:8080 85.214.28.226:8080 104.131.44.150:8080 139.162.108.71:8080 104.131.11.150:443 209.141.54.221:8080 67.205.85.243:8080 62.75.141.82:80 24.179.13.119:80 190.160.53.126:80 194.187.133.160:443 188.219.31.12:80 93.147.212.206:80 37.139.21.175:8080 169.239.182.217:8080 112.185.64.233:80 153.232.188.106:80 110.145.77.103:80 1.221.254.82:80 95.179.229.244:8080 87.106.139.101:8080 192.158.216.73:80 139.59.60.244:8080 200.41.121.90:80 85.66.181.138:80 78.24.219.147:8080 5.196.74.210:8080 157.245.99.39:8080 190.55.181.54:443
rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Suspicious behavior: EnumeratesProcesses ⋅ 2 IoCs

Processes:

E2.bin.exe

pid process

900 E2.bin.exe
900 E2.bin.exe
Suspicious use of SetWindowsHookEx ⋅ 1 IoCs

Processes:

E2.bin.exe

pid process

900 E2.bin.exe

C:\Users\Admin\AppData\Local\Temp\E2.bin.exe

"C:\Users\Admin\AppData\Local\Temp\E2.bin.exe"

Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx

PID:900

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

memory/900-0-0x0000000000230000-0x0000000000242000-memory.dmp

Download
memory/900-1-0x0000000000300000-0x0000000000310000-memory.dmp

Download
memory/1720-2-0x000007FEF70B0000-0x000007FEF732A000-memory.dmp

Download