Analysis
- max time kernel
13s - max time network
124s - platform
windows10_x64 - resource
win10v200722 - submitted
14/09/2020, 16:51
General
- Target emotet_exe_e2_f0523edb5dedba4f3cf6531eeba4f38b7054a6ee6ad0f2f096f652d4c6caeb4a_2020-09-14__165052._exe.exe
- Size 624KB
- Sample200914-7sckcaxyws
- SHA256 f0523edb5dedba4f3cf6531eeba4f38b7054a6ee6ad0f2f096f652d4c6caeb4a
Score
10/10
Malware Config
Extracted
Family
-
emotet
C2
-
104.32.141.43:80
-
104.156.59.7:8080
-
120.138.30.150:8080
-
139.59.67.118:443
-
61.92.17.12:80
-
103.86.49.11:8080
-
174.45.13.118:80
-
75.139.38.211:80
-
104.131.11.150:443
-
121.124.124.40:7080
-
200.114.213.233:8080
-
185.94.252.104:443
-
181.169.34.190:80
-
187.161.206.24:80
-
93.147.212.206:80
-
176.111.60.55:8080
-
83.169.36.251:8080
-
174.102.48.180:443
-
24.179.13.119:80
-
120.150.60.189:80
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_f0523edb5dedba4f3cf6531eeba4f38b7054a6ee6ad0f2f096f652d4c6caeb4a_2020-09-14__165052._exe.exe"C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_f0523edb5dedba4f3cf6531eeba4f38b7054a6ee6ad0f2f096f652d4c6caeb4a_2020-09-14__165052._exe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2968-0-0x0000000000600000-0x0000000000612000-memory.dmp
memory/2968-1-0x0000000000770000-0x0000000000780000-memory.dmp