Analysis
-
max time kernel
60s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-11-2020 17:55
General
-
Target
emotet_exe_e3_f184fd499e35053e56f24435b0470091c92663a23306ec73449462339585aca0_2020-11-17__175437.exe
-
Size
672KB
-
MD5
a633dd5ab515fdc558b3ed2ada4eb661
-
SHA1
f8461feca92f0d5a25b137ae82e6316599d69c6d
-
SHA256
f184fd499e35053e56f24435b0470091c92663a23306ec73449462339585aca0
-
SHA512
edaaf6e8a35dc49077e710f357fd1733ce5b629434aa697938ebe05cae5a072ff0869b5649f5c3690e7a64fd28cd7b25ad337e389c15eedb72df05e36106e00c
Malware Config
Extracted
emotet
Epoch3
116.91.240.96:80
167.71.227.113:8080
190.85.46.52:7080
162.144.42.60:8080
202.166.170.43:80
95.216.205.155:8080
120.51.34.254:80
103.93.220.182:80
111.89.241.139:80
60.125.114.64:443
45.177.120.37:8080
185.86.148.68:443
75.127.14.170:8080
119.92.77.17:80
203.153.216.178:7080
172.96.190.154:8080
179.5.118.12:80
153.229.219.1:443
139.59.12.63:8080
115.79.195.246:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet Payload 2 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_f184fd499e35053e56f24435b0470091c92663a23306ec73449462339585aca0_2020-11-17__175437.exe"C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_f184fd499e35053e56f24435b0470091c92663a23306ec73449462339585aca0_2020-11-17__175437.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3564-0-0x0000000002220000-0x0000000002232000-memory.dmpFilesize
72KB
-
memory/3564-1-0x0000000002240000-0x0000000002250000-memory.dmpFilesize
64KB