Analysis
- max time kernel
130s - max time network
140s - platform
windows7_x64 - resource
win7v20201028 - submitted
13/11/2020, 15:41
General
- Target 40bffbeea96dffb319afcc745abb41ba3f4854123e389b533c3c463c6432d035.exe
- Size 341KB
- Sample201113-tw56dhnnqs
- SHA256 40bffbeea96dffb319afcc745abb41ba3f4854123e389b533c3c463c6432d035
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch1
C2
-
2.45.176.233:80
-
98.103.204.12:443
-
172.86.186.21:8080
-
192.175.111.214:8080
-
109.190.249.106:80
-
177.144.130.105:8080
-
70.32.84.74:8080
-
192.81.38.31:80
-
138.97.60.140:8080
-
189.223.16.99:80
-
175.143.12.123:8080
-
190.115.18.139:8080
-
170.81.48.2:80
-
5.196.35.138:7080
-
172.104.169.32:8080
-
178.250.54.208:8080
-
185.94.252.27:443
-
46.105.114.137:8080
-
79.118.74.90:80
-
70.169.17.134:80
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Emotet Payload 2 IoCs
Detects Emotet payload in memory.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\40bffbeea96dffb319afcc745abb41ba3f4854123e389b533c3c463c6432d035.exe"C:\Users\Admin\AppData\Local\Temp\40bffbeea96dffb319afcc745abb41ba3f4854123e389b533c3c463c6432d035.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1420-2-0x000007FEF72E0000-0x000007FEF755A000-memory.dmp
memory/1756-0-0x00000000002A0000-0x00000000002BC000-memory.dmp
memory/1756-1-0x00000000002C0000-0x00000000002DB000-memory.dmp