Analysis
-
max time kernel
38s -
max time network
50s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-11-2020 17:45
General
-
Target
emotet_exe_e1_b8caacc490263430bf581ea5d9c9585b2ee363ce8d66ac5dc4498ea9bec69dfa_2020-11-17__174458._exe.exe
-
Size
840KB
-
MD5
adcde6ed3ae5099883d2afda64b50d45
-
SHA1
4f1b4f0460aa9fd935bfb591309d0fd475dd2247
-
SHA256
b8caacc490263430bf581ea5d9c9585b2ee363ce8d66ac5dc4498ea9bec69dfa
-
SHA512
f8078344b0475ba0e0afb8def7567e3579494e39d9827cdaba5da569e97d92d82cc9d15ea6582c4c1d94eeafdcf9b17c38d979f56077c5b317136833ac9f551e
Malware Config
Extracted
emotet
Epoch1
197.245.25.228:80
98.103.204.12:443
59.148.253.194:8080
173.212.197.71:8080
87.106.46.107:8080
50.28.51.143:8080
177.73.0.98:443
213.197.182.158:8080
185.94.252.12:80
189.223.16.99:80
5.189.178.202:8080
186.103.141.250:443
181.129.96.162:8080
190.101.156.139:80
46.105.114.137:8080
51.15.7.145:80
98.13.75.196:80
202.134.4.210:7080
104.131.41.185:8080
181.123.6.86:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet Payload 2 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_b8caacc490263430bf581ea5d9c9585b2ee363ce8d66ac5dc4498ea9bec69dfa_2020-11-17__174458._exe.exe"C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_b8caacc490263430bf581ea5d9c9585b2ee363ce8d66ac5dc4498ea9bec69dfa_2020-11-17__174458._exe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3412-0-0x00000000022D0000-0x00000000022E8000-memory.dmpFilesize
96KB
-
memory/3412-1-0x00000000022F0000-0x0000000002307000-memory.dmpFilesize
92KB