emotet | 186c1801f5f5d4149151dbb448d3e41f896f5a387090fa28d9e9c0d201c0ba97

Analysis

max time kernel
145s
max time network
152s
platform
windows10_x64
resource
win10
submitted
30/09/2020, 20:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cliconfg.exe
Size 400KB
Sample200930-cstsszzdnx
SHA256 186c1801f5f5d4149151dbb448d3e41f896f5a387090fa28d9e9c0d201c0ba97
MD5 b20354a06c3dec594e61ef3bdead6f7e
SHA1 4899c9d2fe5591a84924f5bf40c0dc7622effe2f
SHA512 e36ef46e13205a0f992a932e27d14dc5406f906dea519ab81e5567b9303dd6de062465f136793aebbb0ecaa1a2c2064f335719957cbfc83d7bdd68c492747c03
MD5 SHA1 SHA512

Score

10^/10

trojan banker emotet

Malware Config

Extracted

Family

emotet

104.193.103.61:80
104.131.123.136:443
5.196.108.189:8080
121.124.124.40:7080
87.106.139.101:8080
213.196.135.145:80
50.35.17.13:80
38.18.235.242:80
24.43.32.186:80
82.80.155.43:80
103.86.49.11:8080
113.61.66.94:80
24.137.76.62:80
187.49.206.134:80
42.200.107.142:80
24.179.13.119:80
93.147.212.206:80
108.46.29.236:80
105.186.233.33:80
37.139.21.175:8080
61.19.246.238:443
97.82.79.83:80
78.188.106.53:443
168.235.67.138:7080
83.169.36.251:8080
89.216.122.92:80
176.111.60.55:8080
181.169.34.190:80
118.83.154.64:443
140.186.212.146:80
139.59.60.244:8080
174.106.122.139:80
194.187.133.160:443
62.30.7.67:443
68.252.26.78:80
75.139.38.211:80
130.0.132.242:80
172.104.97.173:8080
85.152.162.105:80
74.208.45.104:8080
71.15.245.148:8080
139.162.60.124:8080
62.75.141.82:80
203.153.216.189:7080
91.211.88.52:7080
96.249.236.156:443
95.213.236.64:8080
66.65.136.14:80
104.131.44.150:8080
91.146.156.228:80
79.98.24.39:8080
174.45.13.118:80
157.245.99.39:8080
80.241.255.202:8080
71.72.196.159:80
120.150.60.189:80
220.245.198.194:80
121.7.31.214:80
85.96.199.93:80
67.10.155.92:80
109.74.5.95:8080
188.219.31.12:80
162.241.242.173:8080
110.145.77.103:80
78.24.219.147:8080
47.144.21.12:443
139.99.158.11:443
110.142.236.207:80
94.23.237.171:443
50.91.114.38:80
76.175.162.101:80
46.105.131.79:8080
181.169.235.7:80
87.106.136.232:8080
5.39.91.110:7080
24.43.99.75:80
104.131.11.150:443
139.162.108.71:8080
209.141.54.221:8080
124.41.215.226:80
123.176.25.234:80
137.59.187.107:8080
216.139.123.119:80
94.200.114.161:80
79.137.83.50:443
5.196.74.210:8080
104.236.246.93:8080
137.119.36.33:80
37.187.72.193:8080
172.91.208.86:80
142.112.10.95:20
134.209.36.254:8080
190.240.194.77:443
1.221.254.82:80
185.94.252.104:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet Payload 1 IoCs

Detects Emotet payload in memory.

resource	yara_rule
behavioral2/memory/3104-3-0x00000000022B0000-0x00000000022C0000-memory.dmp	emotet

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3104	cliconfg.exe
3104	cliconfg.exe
3104	cliconfg.exe
3104	cliconfg.exe
3104	cliconfg.exe
3104	cliconfg.exe
3104	cliconfg.exe
3104	cliconfg.exe
3104	cliconfg.exe
3104	cliconfg.exe
3104	cliconfg.exe
3104	cliconfg.exe
3104	cliconfg.exe
3104	cliconfg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3104	cliconfg.exe
3104	cliconfg.exe

C:\Users\Admin\AppData\Local\Temp\cliconfg.exe
"C:\Users\Admin\AppData\Local\Temp\cliconfg.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3104-3-0x00000000022B0000-0x00000000022C0000-memory.dmp

Download