Analysis
- max time kernel
42s - max time network
141s - platform
windows10_x64 - resource
win10v20201028 - submitted
06/11/2020, 11:06
General
- Target ebf414cdd0d16fc90fbbd247577082eb5a42dabd8522dc3073336ed7891b98ad.exe
- Size 504KB
- Sample201106-qc19x2rbaj
- SHA256 ebf414cdd0d16fc90fbbd247577082eb5a42dabd8522dc3073336ed7891b98ad
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch1
C2
-
186.189.249.2:80
-
59.148.253.194:8080
-
173.212.197.71:8080
-
5.89.33.136:80
-
177.144.130.105:443
-
190.190.219.184:80
-
82.76.111.249:443
-
70.32.115.157:8080
-
62.84.75.50:80
-
190.24.243.186:80
-
51.15.7.145:80
-
24.232.228.233:80
-
46.105.114.137:8080
-
216.47.196.104:80
-
172.86.186.21:8080
-
186.103.141.250:443
-
128.92.203.42:80
-
190.188.245.242:80
-
152.169.22.67:80
-
170.81.48.2:80
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Emotet Payload 2 IoCs
Detects Emotet payload in memory.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebf414cdd0d16fc90fbbd247577082eb5a42dabd8522dc3073336ed7891b98ad.exe"C:\Users\Admin\AppData\Local\Temp\ebf414cdd0d16fc90fbbd247577082eb5a42dabd8522dc3073336ed7891b98ad.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/984-0-0x0000000002280000-0x00000000022A2000-memory.dmp
memory/984-1-0x00000000022B0000-0x00000000022D1000-memory.dmp