Analysis
-
max time kernel
132s -
max time network
137s -
platform
windows7_x64 -
resource
win7 -
submitted
09-09-2020 17:32
General
-
Target
E2.bin.exe
-
Size
608KB
-
MD5
b4b4e2489e8d2bf539e08b7df7d34128
-
SHA1
46d3f03752809c6f5abf66f17d8562beb60451af
-
SHA256
37db086d928b34c1f967cfc26b56c48df99d6024be493345880af15f21a453a2
-
SHA512
d6765bc3ad13e6dac4f22bdae8d27dfcff27dd8cfb33b46820f958e5f8c566439919d9b56d36a50d1c333ad46fe1a9492ef52d049fc94d070344a71cef99c2ab
Score
10/10
Malware Config
Extracted
Family
emotet
C2
50.91.114.38:80
120.138.30.150:8080
139.59.67.118:443
94.23.216.33:80
107.5.122.110:80
95.213.236.64:8080
84.39.182.7:80
47.144.21.12:443
200.114.213.233:8080
176.111.60.55:8080
70.180.43.7:80
121.124.124.40:7080
113.160.130.116:8443
103.86.49.11:8080
85.105.205.77:8080
174.102.48.180:443
37.187.72.193:8080
189.212.199.126:443
85.152.162.105:80
104.236.246.93:8080
rsa_pubkey.plain
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\E2.bin.exe"C:\Users\Admin\AppData\Local\Temp\E2.bin.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/900-0-0x0000000000230000-0x0000000000242000-memory.dmpFilesize
72KB
-
memory/900-1-0x0000000000300000-0x0000000000310000-memory.dmpFilesize
64KB
-
memory/1720-2-0x000007FEF70B0000-0x000007FEF732A000-memory.dmpFilesize
2.5MB