Analysis
- max time kernel
147s - max time network
153s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:44
General
- Target 720c106d35cd7a54253a30b08d0cadee39ff309fd5d04396c9f87f8433829a98.exe
- Size 824KB
- Sample201109-er7txc18k2
- SHA256 720c106d35cd7a54253a30b08d0cadee39ff309fd5d04396c9f87f8433829a98
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch2
C2
-
84.21.179.51:80
-
95.216.118.202:8080
-
98.15.140.226:80
-
176.9.43.37:8080
-
62.75.141.82:80
-
60.250.78.22:443
-
95.128.43.213:8080
-
195.244.215.206:80
-
78.189.165.52:8080
-
104.131.44.150:8080
-
93.51.50.171:8080
-
59.20.65.102:80
-
195.76.232.114:80
-
95.213.236.64:8080
-
186.208.123.210:443
-
50.116.86.205:8080
-
160.16.215.66:8080
-
24.94.237.248:80
-
114.145.241.208:80
-
176.111.60.55:8080
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Suspicious behavior: EmotetMutantsSpam 1 IoCs
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\720c106d35cd7a54253a30b08d0cadee39ff309fd5d04396c9f87f8433829a98.exe"C:\Users\Admin\AppData\Local\Temp\720c106d35cd7a54253a30b08d0cadee39ff309fd5d04396c9f87f8433829a98.exe"1⤵
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4032-0-0x0000000002260000-0x000000000226E000-memory.dmp
memory/4032-1-0x0000000002270000-0x000000000227C000-memory.dmp
memory/4032-2-0x0000000000400000-0x000000000040C000-memory.dmp