Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-11-2020 14:28
General
-
Target
b3c8a7c6ecbcadd3f00cd02e8e2f7077.exe
-
Size
224KB
-
MD5
2ece6d5d40b63d0986597a7c862a4193
-
SHA1
bbda159b63d52382c2d1f9a45d574b0d7b831275
-
SHA256
b9064d32cbe5e7257612b0ccaacbe625d8a7788bc0d30c4569934b49f58593d8
-
SHA512
0bb2bd5ff15998c5307310b6aa374c76e25e835f737d31fc50a4e5a96f9a3d142ce0d1365b7f116d38abc39ee09aa1ef8bc0c31233d34eb13e750739ac22a6c8
Malware Config
Extracted
emotet
Epoch2
154.91.33.137:443
49.12.113.171:8080
167.114.153.111:8080
87.106.136.232:8080
110.145.77.103:80
74.214.230.200:80
186.74.215.34:80
37.179.204.33:80
172.86.188.251:8080
75.188.96.231:80
118.83.154.64:443
209.54.13.14:80
176.113.52.6:443
97.82.79.83:80
112.185.64.233:80
119.59.116.21:8080
62.171.142.179:8080
62.75.141.82:80
139.99.158.11:443
50.91.114.38:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet Payload 2 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3c8a7c6ecbcadd3f00cd02e8e2f7077.exe"C:\Users\Admin\AppData\Local\Temp\b3c8a7c6ecbcadd3f00cd02e8e2f7077.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/508-0-0x0000000002180000-0x0000000002195000-memory.dmpFilesize
84KB
-
memory/508-1-0x00000000021C0000-0x00000000021D3000-memory.dmpFilesize
76KB