Analysis

  • max time kernel
    38s
  • max time network
    143s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    17-11-2020 17:54

General

  • Target

    emotet_exe_e3_7cc0f3d59bb35ae0446ed54c7dcbc04e1e79f0e21aed7f0af957e67f769959b3_2020-11-17__175433._exe.exe

  • Size

    838KB

  • MD5

    5423cb04de5b9685a262595c3a1296c8

  • SHA1

    0d1653b11b23d210337575d9151d4b00645d8fff

  • SHA256

    7cc0f3d59bb35ae0446ed54c7dcbc04e1e79f0e21aed7f0af957e67f769959b3

  • SHA512

    a0ba56e3ea367a8951e19cb4372360b4165a47771353e4802287eba0cbae9560ca2ed0f2506320728ab7af4b8d0dd9e02f4d4a6ee14929efc8a9f687d76666b6

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

85.246.78.192:80

188.226.165.170:8080

188.40.170.197:80

51.38.50.144:8080

175.103.38.146:80

192.210.217.94:8080

180.23.53.200:80

202.29.237.113:8080

58.27.215.3:8080

190.85.46.52:7080

36.91.44.183:80

190.164.135.81:80

37.205.9.252:7080

192.241.220.183:8080

5.2.246.108:80

180.21.3.52:80

85.75.49.113:80

190.55.186.229:80

116.91.240.96:80

180.148.4.130:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet Payload 2 IoCs

    Detects Emotet payload in memory.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_7cc0f3d59bb35ae0446ed54c7dcbc04e1e79f0e21aed7f0af957e67f769959b3_2020-11-17__175433._exe.exe
    "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_7cc0f3d59bb35ae0446ed54c7dcbc04e1e79f0e21aed7f0af957e67f769959b3_2020-11-17__175433._exe.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4040-0-0x0000000002110000-0x0000000002128000-memory.dmp
    Filesize

    96KB

  • memory/4040-1-0x00000000021E0000-0x00000000021F7000-memory.dmp
    Filesize

    92KB