emotet | d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b

Analysis

max time kernel
42s
max time network
153s
platform
windows10_x64
resource
win10v20201028
submitted
05-11-2020 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b.exe
Size

352KB
MD5

845c1812eb81a42882612e17e85a40be
SHA1

1bd4f31d6e895a0b006f5b850f079e731efa9ed3
SHA256

d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b
SHA512

c2933a33a9914aa809b414bd3a48fbe6b242ff58383d6ea43d094daab7666bf4a80604e999f75e0a682c330cf68379651e712585237d7318d1a640bafe775fff

Score

10^/10

emotet epoch3 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

152.32.75.74:443

91.121.200.35:8080

159.203.16.11:8080

188.226.165.170:8080

172.193.79.237:80

123.216.134.52:80

183.91.3.63:80

139.59.61.215:443

185.80.172.199:80

77.74.78.80:443

153.229.219.1:443

113.203.238.130:80

120.51.34.254:80

116.202.10.123:8080

5.2.246.108:80

50.116.78.109:8080

103.80.51.61:8080

190.55.186.229:80

185.142.236.163:443

223.17.215.76:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet Payload 2 IoCs

Detects Emotet payload in memory.

Processes:

resource	yara_rule
behavioral2/memory/2268-0-0x0000000002620000-0x000000000265D000-memory.dmp	emotet
behavioral2/memory/2268-1-0x0000000002660000-0x000000000269C000-memory.dmp	emotet

Modifies data under HKEY_USERS 1 IoCs

Processes:

svchost.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b.exe

pid	process
2268	d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b.exe
2268	d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b.exe
2268	d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b.exe
2268	d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b.exe
2268	d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b.exe
2268	d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b.exe

C:\Users\Admin\AppData\Local\Temp\d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b.exe
"C:\Users\Admin\AppData\Local\Temp\d45ae96f83a29836fcbca8d5d7939c05644437b75bf2c278b676382acbf1ce0b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2268

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NgcSvc
1⤵
PID:1652

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
1⤵
PID:2464

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2268-0-0x0000000002620000-0x000000000265D000-memory.dmp

Filesize
244KB

Download
memory/2268-1-0x0000000002660000-0x000000000269C000-memory.dmp

Filesize
240KB

Download