emotet | f9aa9694a3400b62fa621733535a116cb25e4bf4b9b9742b7c7d0c577aa4ae53

Analysis

max time kernel
63s
max time network
148s
platform
windows7_x64
resource
win7
submitted
25/10/2020, 18:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4f9f8247b79ecd8aa189ccc4fd98422b.exe
Size 714KB
Sample201025-h45hap892x
SHA256 f9aa9694a3400b62fa621733535a116cb25e4bf4b9b9742b7c7d0c577aa4ae53
MD5 4f9f8247b79ecd8aa189ccc4fd98422b
SHA1 bcebd31418b68e6c1c7192c93f14bbe12598bd0a
SHA512 cdf17ea40e46e2f4ec1fb76c705167d27f5282ed1aa674f5d43b40e535ecc0fe16c3d65dd3124f17f92f6e29d488635c38bfd33956f5c56974352d8a280718e3
MD5 SHA1 SHA512

Score

10^/10

trojan banker emotet

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

186.189.249.2:80
59.148.253.194:8080
173.212.197.71:8080
5.89.33.136:80
177.144.130.105:443
190.190.219.184:80
82.76.111.249:443
70.32.115.157:8080
62.84.75.50:80
190.24.243.186:80
51.15.7.145:80
24.232.228.233:80
46.105.114.137:8080
216.47.196.104:80
172.86.186.21:8080
186.103.141.250:443
128.92.203.42:80
190.188.245.242:80
152.169.22.67:80
170.81.48.2:80
178.211.45.66:8080
201.71.228.86:80
111.67.12.221:8080
70.169.17.134:80
5.196.35.138:7080
104.131.41.185:8080
60.93.23.51:80
181.123.6.86:80
137.74.106.111:7080
51.15.7.189:80
94.176.234.118:443
74.135.120.91:80
188.135.15.49:80
77.78.196.173:443
177.73.0.98:443
213.52.74.198:80
177.144.130.105:8080
177.74.228.34:80
209.236.123.42:8080
37.187.161.206:8080
174.118.202.24:443
178.250.54.208:8080
109.190.35.249:80
188.251.213.180:80
191.182.6.118:80
64.201.88.132:80
79.118.74.90:80
177.129.17.170:443
212.71.237.140:8080
109.190.249.106:80
192.232.229.54:7080
189.223.16.99:80
201.213.177.139:80
85.214.26.7:8080
191.191.23.135:80
46.43.2.95:8080
50.28.51.143:8080
98.103.204.12:443
37.179.145.105:80
46.101.58.37:8080
2.45.176.233:80
74.58.215.226:80
68.183.190.199:8080
185.94.252.27:443
186.222.250.115:8080
51.255.165.160:8080
138.97.60.140:8080
183.176.82.231:80
105.209.235.113:8080
77.238.212.227:80
103.236.179.162:80
45.46.37.97:80
83.169.21.32:7080
217.13.106.14:8080
68.183.170.114:8080
192.241.143.52:8080
202.134.4.210:7080
177.23.7.151:80
192.81.38.31:80
188.157.101.114:80
185.183.16.47:80
181.129.96.162:8080
87.106.46.107:8080
149.202.72.142:7080
45.33.77.42:8080
186.70.127.199:8090
175.143.12.123:8080
98.13.75.196:80
12.163.208.58:80
5.189.178.202:8080
138.97.60.141:7080
181.30.61.163:443
219.92.13.25:80
181.61.182.143:80
213.197.182.158:8080
1.226.84.243:8080
12.162.84.2:8080
189.2.177.210:443
185.94.252.12:80
51.75.33.127:80
190.115.18.139:8080
70.32.84.74:8080
81.215.230.173:443
172.104.169.32:8080
37.183.81.217:80
200.127.14.97:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet Payload 4 IoCs

Detects Emotet payload in memory.

resource	yara_rule
behavioral1/memory/1552-0-0x0000000000390000-0x00000000003B2000-memory.dmp	emotet
behavioral1/memory/1552-1-0x00000000003C0000-0x00000000003E1000-memory.dmp	emotet
behavioral1/memory/1876-4-0x0000000000320000-0x0000000000342000-memory.dmp	emotet
behavioral1/memory/1876-5-0x0000000000350000-0x0000000000371000-memory.dmp	emotet

Executes dropped EXE 1 IoCs

pid	Process
1876	Microsoft.Management.Infrastructure.Native.Unmanaged.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\AuditNativeSnapIn\Microsoft.Management.Infrastructure.Native.Unmanaged.exe	4f9f8247b79ecd8aa189ccc4fd98422b.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1876	Microsoft.Management.Infrastructure.Native.Unmanaged.exe
1876	Microsoft.Management.Infrastructure.Native.Unmanaged.exe
1876	Microsoft.Management.Infrastructure.Native.Unmanaged.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1552	4f9f8247b79ecd8aa189ccc4fd98422b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1552	4f9f8247b79ecd8aa189ccc4fd98422b.exe
1876	Microsoft.Management.Infrastructure.Native.Unmanaged.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1876	1552	4f9f8247b79ecd8aa189ccc4fd98422b.exe	25
PID 1552 wrote to memory of 1876	1552	4f9f8247b79ecd8aa189ccc4fd98422b.exe	25
PID 1552 wrote to memory of 1876	1552	4f9f8247b79ecd8aa189ccc4fd98422b.exe	25
PID 1552 wrote to memory of 1876	1552	4f9f8247b79ecd8aa189ccc4fd98422b.exe	25

C:\Users\Admin\AppData\Local\Temp\4f9f8247b79ecd8aa189ccc4fd98422b.exe
"C:\Users\Admin\AppData\Local\Temp\4f9f8247b79ecd8aa189ccc4fd98422b.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\AuditNativeSnapIn\Microsoft.Management.Infrastructure.Native.Unmanaged.exe
  "C:\Windows\SysWOW64\AuditNativeSnapIn\Microsoft.Management.Infrastructure.Native.Unmanaged.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/816-6-0x000007FEF6350000-0x000007FEF65CA000-memory.dmp

Download

memory/1552-0-0x0000000000390000-0x00000000003B2000-memory.dmp

Download

memory/1552-1-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/1876-4-0x0000000000320000-0x0000000000342000-memory.dmp

Download

memory/1876-5-0x0000000000350000-0x0000000000371000-memory.dmp

Download