Analysis
- max time kernel
150s - max time network
152s - platform
windows10_x64 - resource
win10v200722 - submitted
14/09/2020, 16:51
General
- Target emotet_exe_e2_6cea4f7e4fc63951be0ea47a2fd02ac18c423af1a67e3a6b39aa4dc9b26366f2_2020-09-14__165051._exe.exe
- Size 624KB
- Sample200914-ef8e2zm3nx
- SHA256 6cea4f7e4fc63951be0ea47a2fd02ac18c423af1a67e3a6b39aa4dc9b26366f2
Score
10/10
Malware Config
Extracted
Family
-
emotet
C2
-
104.32.141.43:80
-
104.156.59.7:8080
-
120.138.30.150:8080
-
139.59.67.118:443
-
61.92.17.12:80
-
103.86.49.11:8080
-
174.45.13.118:80
-
75.139.38.211:80
-
104.131.11.150:443
-
121.124.124.40:7080
-
200.114.213.233:8080
-
185.94.252.104:443
-
181.169.34.190:80
-
187.161.206.24:80
-
93.147.212.206:80
-
176.111.60.55:8080
-
83.169.36.251:8080
-
174.102.48.180:443
-
24.179.13.119:80
-
120.150.60.189:80
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_6cea4f7e4fc63951be0ea47a2fd02ac18c423af1a67e3a6b39aa4dc9b26366f2_2020-09-14__165051._exe.exe"C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_6cea4f7e4fc63951be0ea47a2fd02ac18c423af1a67e3a6b39aa4dc9b26366f2_2020-09-14__165051._exe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4016-0-0x00000000023B0000-0x00000000023C2000-memory.dmp
memory/4016-1-0x0000000002270000-0x0000000002280000-memory.dmp