Analysis
- max time kernel
150s - max time network
158s - platform
windows7_x64 - resource
win7 - submitted
15/10/2020, 19:32
General
- Target emotet_exe_e1_ec2c142da4d44e392930a9c12dd30c3fcdd4101a316eaa4f160719458c8c6bfa_2020-10-15__193136._exe.exe
- Size 339KB
- Sample201015-1cd76jty3a
- SHA256 ec2c142da4d44e392930a9c12dd30c3fcdd4101a316eaa4f160719458c8c6bfa
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch1
C2
-
190.96.15.50:80
-
192.175.111.214:8080
-
95.85.33.23:8080
-
192.232.229.54:7080
-
200.127.14.97:80
-
190.188.245.242:80
-
51.15.7.145:80
-
138.97.60.140:8080
-
98.13.75.196:80
-
213.52.74.198:80
-
74.58.215.226:80
-
192.81.38.31:80
-
191.182.6.118:80
-
212.71.237.140:8080
-
209.236.123.42:8080
-
60.93.23.51:80
-
178.211.45.66:8080
-
190.24.243.186:80
-
62.84.75.50:80
-
50.121.220.50:80
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Emotet Payload 2 IoCs
Detects Emotet payload in memory.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_ec2c142da4d44e392930a9c12dd30c3fcdd4101a316eaa4f160719458c8c6bfa_2020-10-15__193136._exe.exe"C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_ec2c142da4d44e392930a9c12dd30c3fcdd4101a316eaa4f160719458c8c6bfa_2020-10-15__193136._exe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1492-0-0x00000000003C0000-0x00000000003E0000-memory.dmp
memory/1492-1-0x00000000003E0000-0x00000000003FF000-memory.dmp
memory/1584-2-0x000007FEF7E70000-0x000007FEF80EA000-memory.dmp