emotet | 108d3cde95cc5345d4e63ed99f5e834a7e9993cb8f63b140f44d7469ee1bbbcb

Analysis

max time kernel
135s
max time network
145s
platform
windows7_x64
resource
win7v20201028
submitted
09/11/2020, 20:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
108d3cde95cc5345d4e63ed99f5e834a7e9993cb8f63b140f44d7469ee1bbbcb.exe
Size 508KB
Sample201109-s7wpf41af2
SHA256 108d3cde95cc5345d4e63ed99f5e834a7e9993cb8f63b140f44d7469ee1bbbcb
MD5 d1ced660df4b8efae313e3ccec03952f
SHA1 2f2ff7d97087201b7e1c170cef21e44c4e9c4191
SHA512 928032606297354783156e7c247c5b4f96bd8d46aec60454e516bee6b9192c949caabf930867500e07363f7c8bac985683a3e4d06e8a1439a9732a88fa9fa270
MD5 SHA1 SHA512

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

201.17.193.151:443
190.2.31.172:80
185.10.202.137:8080
103.31.232.93:443
110.145.101.66:443
49.176.162.90:443
190.210.184.138:995
177.6.166.4:80
72.47.248.48:7080
70.32.84.74:8080
12.162.84.2:8080
191.92.120.49:80
82.8.232.51:80
117.7.236.115:80
83.169.21.32:7080
177.66.190.130:80
210.186.132.68:80
120.151.194.117:80
68.183.190.199:8080
81.16.1.45:80
200.58.83.179:80
177.72.13.80:80
118.69.71.14:80
41.60.202.26:443
190.219.149.236:80
192.241.143.52:8080
190.17.195.202:80
104.131.41.185:8080
186.138.186.74:443
114.109.179.60:80
50.28.51.143:8080
129.205.201.163:80
79.10.57.78:80
77.55.211.77:8080
190.52.207.190:7080
185.94.252.13:443
201.213.32.59:80
172.104.169.32:8080
139.218.104.239:80
179.127.59.210:443
204.225.249.100:7080
188.216.24.204:80
94.176.234.118:443
68.174.15.223:80
181.60.244.48:8080
190.13.215.114:80
91.236.4.234:443
138.68.106.4:7080
70.184.69.146:80
152.170.196.157:443
190.195.129.227:8090
181.52.73.233:80
82.196.15.205:8080
91.83.93.124:7080
181.30.69.50:80
189.123.239.235:80
178.79.163.131:8080
191.103.76.34:443
181.122.172.67:8080
192.241.146.84:8080
200.127.51.94:80
104.236.161.64:8080
144.139.91.187:80
94.76.247.61:8080
70.32.115.157:8080
110.145.124.178:443
89.216.23.167:80
104.131.103.37:8080
201.213.100.141:8080
190.57.130.142:443
175.139.209.3:8080
190.143.38.211:80
147.83.10.59:80
203.25.159.3:8080
187.162.248.237:80
172.221.229.86:80
111.67.12.221:8080
182.191.75.93:443
200.82.170.231:80
175.114.178.83:443
203.45.161.179:443
181.36.42.205:443
189.19.81.181:443
181.60.247.8:443
212.71.237.140:8080
86.42.166.147:80
143.0.87.101:80
181.54.245.85:8080
147.83.10.212:80
46.28.111.142:7080
77.90.136.129:8080
189.1.185.248:80
186.68.48.204:443
93.147.157.195:80
177.103.159.44:80
91.219.169.180:80
189.220.246.167:80
149.62.173.247:8080
189.14.80.194:443
190.165.21.5:80
5.196.35.138:7080
190.70.1.69:80
86.247.108.13:8080
200.45.187.90:80
5.45.108.146:8080
37.187.6.63:8080
185.94.252.27:443
190.24.243.186:80
190.186.164.23:80
113.61.66.94:80
120.150.76.215:80
152.231.89.226:80
186.250.113.201:80
201.82.155.121:80
186.3.232.68:80
181.231.220.232:80
191.183.21.190:80
217.199.160.224:8080
74.101.225.121:443
185.32.46.109:80
88.249.1.225:443
89.19.20.202:443
115.160.150.86:80
200.58.180.130:80
189.180.84.98:443
73.239.11.159:80
152.169.32.195:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EmotetMutantsSpam 2 IoCs

pid	Process
1424	108d3cde95cc5345d4e63ed99f5e834a7e9993cb8f63b140f44d7469ee1bbbcb.exe
1664	api-ms-win-downlevel-advapi32-l1-1-0.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1664	api-ms-win-downlevel-advapi32-l1-1-0.exe
1664	api-ms-win-downlevel-advapi32-l1-1-0.exe
1664	api-ms-win-downlevel-advapi32-l1-1-0.exe
1664	api-ms-win-downlevel-advapi32-l1-1-0.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1424	108d3cde95cc5345d4e63ed99f5e834a7e9993cb8f63b140f44d7469ee1bbbcb.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1424	108d3cde95cc5345d4e63ed99f5e834a7e9993cb8f63b140f44d7469ee1bbbcb.exe
1424	108d3cde95cc5345d4e63ed99f5e834a7e9993cb8f63b140f44d7469ee1bbbcb.exe
1664	api-ms-win-downlevel-advapi32-l1-1-0.exe
1664	api-ms-win-downlevel-advapi32-l1-1-0.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 1664	1424	108d3cde95cc5345d4e63ed99f5e834a7e9993cb8f63b140f44d7469ee1bbbcb.exe	29
PID 1424 wrote to memory of 1664	1424	108d3cde95cc5345d4e63ed99f5e834a7e9993cb8f63b140f44d7469ee1bbbcb.exe	29
PID 1424 wrote to memory of 1664	1424	108d3cde95cc5345d4e63ed99f5e834a7e9993cb8f63b140f44d7469ee1bbbcb.exe	29
PID 1424 wrote to memory of 1664	1424	108d3cde95cc5345d4e63ed99f5e834a7e9993cb8f63b140f44d7469ee1bbbcb.exe	29

C:\Users\Admin\AppData\Local\Temp\108d3cde95cc5345d4e63ed99f5e834a7e9993cb8f63b140f44d7469ee1bbbcb.exe
"C:\Users\Admin\AppData\Local\Temp\108d3cde95cc5345d4e63ed99f5e834a7e9993cb8f63b140f44d7469ee1bbbcb.exe"
1⤵
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0\api-ms-win-downlevel-advapi32-l1-1-0.exe
  "C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0\api-ms-win-downlevel-advapi32-l1-1-0.exe"
  2⤵
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1424-0-0x0000000000350000-0x000000000035C000-memory.dmp

Download

memory/1424-1-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1664-3-0x0000000000230000-0x000000000023C000-memory.dmp

Download

memory/1664-4-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1944-5-0x000007FEF61D0000-0x000007FEF644A000-memory.dmp

Download