Analysis
- max time kernel
134s - max time network
142s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:45
General
- Target 289ae5dd79a23a2ae17bce2184c7de2fc038e6e531eabd265fd2cc4a2b5dc570.exe
- Size 386KB
- Sample201109-rxarkcmzj2
- SHA256 289ae5dd79a23a2ae17bce2184c7de2fc038e6e531eabd265fd2cc4a2b5dc570
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch2
C2
-
190.144.18.198:80
-
82.223.70.24:8080
-
41.60.200.34:80
-
62.75.187.192:8080
-
93.51.50.171:8080
-
114.145.241.208:80
-
110.145.77.103:80
-
120.151.135.224:80
-
104.131.11.150:443
-
190.160.53.126:80
-
113.160.130.116:8443
-
87.106.136.232:8080
-
68.44.137.144:443
-
95.128.43.213:8080
-
59.20.65.102:80
-
78.24.219.147:8080
-
162.241.92.219:8080
-
176.9.43.37:8080
-
37.139.21.175:8080
-
62.75.141.82:80
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Suspicious behavior: EmotetMutantsSpam 1 IoCs
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\289ae5dd79a23a2ae17bce2184c7de2fc038e6e531eabd265fd2cc4a2b5dc570.exe"C:\Users\Admin\AppData\Local\Temp\289ae5dd79a23a2ae17bce2184c7de2fc038e6e531eabd265fd2cc4a2b5dc570.exe"1⤵
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/912-1-0x0000000000550000-0x000000000055C000-memory.dmp
memory/912-0-0x00000000004F0000-0x00000000004FE000-memory.dmp
memory/912-2-0x0000000000400000-0x000000000040C000-memory.dmp