Analysis
-
max time kernel
124s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-11-2020 17:55
General
-
Target
emotet_exe_e3_5343ebf85b48060d70e2abe0e5e2e30f730263df12252e717b4a08e1561470b7_2020-11-17__175433.exe
-
Size
352KB
-
MD5
002b0435f4bb3231db9ecafe3987795a
-
SHA1
661b8b6fb14e9f4dbfe7865be7073e1bd2f1d6b9
-
SHA256
5343ebf85b48060d70e2abe0e5e2e30f730263df12252e717b4a08e1561470b7
-
SHA512
f03fa1861429099b2d6f4a56d4530e1005534256665c762bb34d7495a07276dd0ad40f80bd0fb42792e4f295624f29d4869dee7106a02a38b2c00d4ff07ae3c8
Malware Config
Extracted
emotet
Epoch3
152.32.75.74:443
91.121.200.35:8080
159.203.16.11:8080
188.226.165.170:8080
172.193.79.237:80
123.216.134.52:80
183.91.3.63:80
139.59.61.215:443
185.80.172.199:80
77.74.78.80:443
153.229.219.1:443
113.203.238.130:80
120.51.34.254:80
116.202.10.123:8080
5.2.246.108:80
50.116.78.109:8080
103.80.51.61:8080
190.55.186.229:80
185.142.236.163:443
223.17.215.76:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet Payload 2 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_5343ebf85b48060d70e2abe0e5e2e30f730263df12252e717b4a08e1561470b7_2020-11-17__175433.exe"C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_5343ebf85b48060d70e2abe0e5e2e30f730263df12252e717b4a08e1561470b7_2020-11-17__175433.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/672-2-0x000007FEF7800000-0x000007FEF7A7A000-memory.dmpFilesize
2.5MB
-
memory/1080-0-0x0000000002380000-0x00000000023BD000-memory.dmpFilesize
244KB
-
memory/1080-1-0x00000000023C0000-0x00000000023FC000-memory.dmpFilesize
240KB