59a6b5899676d73c5867cfe180bae7d54b8c8c44c57b75ea3e9e4645712dee29

General
Target

59a6b5899676d73c5867cfe180bae7d54b8c8c44c57b75ea3e9e4645712dee29.exe

Filesize

361KB

Completed

18-10-2020 05:36

Score
10 /10
MD5

68efb3e4e35aefebd1055d9d8512b464

SHA1

3ea41acde56be265498c3df6fbd3634099f7c323

SHA256

59a6b5899676d73c5867cfe180bae7d54b8c8c44c57b75ea3e9e4645712dee29

Malware Config

Extracted

Family emotet
Botnet Epoch3
C2

221.147.142.214:80

188.40.170.197:80

51.38.50.144:8080

46.22.116.163:7080

190.151.5.131:443

58.27.215.3:8080

179.5.118.12:80

73.100.19.104:80

192.210.217.94:8080

192.163.221.191:8080

103.93.220.182:80

91.213.106.100:8080

190.192.39.136:80

115.79.59.157:80

190.164.135.81:80

91.83.93.103:443

188.166.220.180:7080

116.202.10.123:8080

36.91.44.183:80

77.74.78.80:443

153.229.219.1:443

190.191.171.72:80

78.186.65.230:80

37.205.9.252:7080

180.21.3.52:80

126.126.139.26:443

212.198.71.39:80

180.148.4.130:8080

190.55.186.229:80

190.117.101.56:80

5.79.70.250:8080

50.116.78.109:8080

185.142.236.163:443

116.91.240.96:80

42.200.96.63:80

190.85.46.52:7080

79.133.6.236:8080

24.231.51.190:80

8.4.9.137:8080

41.76.213.144:8080

175.103.38.146:80

178.33.167.120:8080

143.95.101.72:8080

109.206.139.119:80

121.117.147.153:443

75.127.14.170:8080

46.105.131.68:8080

195.201.56.70:8080

223.17.215.76:80

85.75.49.113:80

rsa_pubkey.plain
Signatures 4

Filter: none

  • Emotet

    Description

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet Payload

    Description

    Detects Emotet payload in memory.

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/3980-0-0x0000000002280000-0x000000000229C000-memory.dmpemotet
    behavioral1/memory/3980-1-0x00000000022A0000-0x00000000022BB000-memory.dmpemotet
  • Suspicious behavior: EnumeratesProcesses
    59a6b5899676d73c5867cfe180bae7d54b8c8c44c57b75ea3e9e4645712dee29.exe

    Reported IOCs

    pidprocess
    398059a6b5899676d73c5867cfe180bae7d54b8c8c44c57b75ea3e9e4645712dee29.exe
    398059a6b5899676d73c5867cfe180bae7d54b8c8c44c57b75ea3e9e4645712dee29.exe
    398059a6b5899676d73c5867cfe180bae7d54b8c8c44c57b75ea3e9e4645712dee29.exe
    398059a6b5899676d73c5867cfe180bae7d54b8c8c44c57b75ea3e9e4645712dee29.exe
  • Suspicious use of SetWindowsHookEx
    59a6b5899676d73c5867cfe180bae7d54b8c8c44c57b75ea3e9e4645712dee29.exe

    Reported IOCs

    pidprocess
    398059a6b5899676d73c5867cfe180bae7d54b8c8c44c57b75ea3e9e4645712dee29.exe
Processes
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/3980-0-0x0000000002280000-0x000000000229C000-memory.dmp

                            Download
                          • memory/3980-1-0x00000000022A0000-0x00000000022BB000-memory.dmp

                            Download