Analysis
- max time kernel
132s - max time network
149s - platform
windows7_x64 - resource
win7 - submitted
16/10/2020, 00:13
General
- Target emotet_exe_e1_5d8e61b7abe0e73bb6bd1986474fc30435c2b3242bdbae5a8e1834bd830ad1b6_2020-10-16__001215._exe.exe
- Size 903KB
- Sample201016-5jsarsj6bx
- SHA256 5d8e61b7abe0e73bb6bd1986474fc30435c2b3242bdbae5a8e1834bd830ad1b6
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch1
C2
-
190.96.15.50:80
-
192.175.111.214:8080
-
95.85.33.23:8080
-
192.232.229.54:7080
-
200.127.14.97:80
-
190.188.245.242:80
-
51.15.7.145:80
-
138.97.60.140:8080
-
98.13.75.196:80
-
213.52.74.198:80
-
74.58.215.226:80
-
192.81.38.31:80
-
191.182.6.118:80
-
212.71.237.140:8080
-
209.236.123.42:8080
-
60.93.23.51:80
-
178.211.45.66:8080
-
190.24.243.186:80
-
62.84.75.50:80
-
50.121.220.50:80
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Emotet Payload 2 IoCs
Detects Emotet payload in memory.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_5d8e61b7abe0e73bb6bd1986474fc30435c2b3242bdbae5a8e1834bd830ad1b6_2020-10-16__001215._exe.exe"C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_5d8e61b7abe0e73bb6bd1986474fc30435c2b3242bdbae5a8e1834bd830ad1b6_2020-10-16__001215._exe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1324-0-0x0000000000320000-0x0000000000340000-memory.dmp
memory/1324-1-0x00000000003D0000-0x00000000003EF000-memory.dmp
memory/1744-2-0x000007FEF63E0000-0x000007FEF665A000-memory.dmp