Analysis
- max time kernel
43s - max time network
128s - platform
windows10_x64 - resource
win10v20201028 - submitted
17/11/2020, 12:08
General
- Target 2a4c914a71a6e8d990045c50684c204e.exe
- Size 400KB
- Sample201117-ch9xe54gb2
- SHA256 0927627d937d5aa8a02e60bf56a9aaa54a92f20c5d0ab56e857775b94fecc01e
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch2
C2
-
102.182.145.130:80
-
173.173.254.105:80
-
64.207.182.168:8080
-
51.89.199.141:8080
-
167.114.153.111:8080
-
173.63.222.65:80
-
218.147.193.146:80
-
59.125.219.109:443
-
172.104.97.173:8080
-
190.162.215.233:80
-
68.115.186.26:80
-
78.188.106.53:443
-
190.240.194.77:443
-
24.133.106.23:80
-
80.227.52.78:80
-
79.137.83.50:443
-
120.150.218.241:443
-
62.171.142.179:8080
-
194.4.58.192:7080
-
62.30.7.67:443
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Emotet Payload 1 IoCs
Detects Emotet payload in memory.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a4c914a71a6e8d990045c50684c204e.exe"C:\Users\Admin\AppData\Local\Temp\2a4c914a71a6e8d990045c50684c204e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/552-3-0x0000000002BB0000-0x0000000002BC0000-memory.dmp