Overview

overview

10

Static

static

emotet_exe...33.exe

windows7_x64

10

emotet_exe...33.exe

windows10_x64

10

Analysis

  • max time kernel
    37s
  • max time network
    144s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    17-11-2020 17:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    emotet_exe_e3_5343ebf85b48060d70e2abe0e5e2e30f730263df12252e717b4a08e1561470b7_2020-11-17__175433.exe

  • Size

    352KB

  • MD5

    002b0435f4bb3231db9ecafe3987795a

  • SHA1

    661b8b6fb14e9f4dbfe7865be7073e1bd2f1d6b9

  • SHA256

    5343ebf85b48060d70e2abe0e5e2e30f730263df12252e717b4a08e1561470b7

  • SHA512

    f03fa1861429099b2d6f4a56d4530e1005534256665c762bb34d7495a07276dd0ad40f80bd0fb42792e4f295624f29d4869dee7106a02a38b2c00d4ff07ae3c8

Score
10/10
emotetepoch3bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

152.32.75.74:443

91.121.200.35:8080

159.203.16.11:8080

188.226.165.170:8080

172.193.79.237:80

123.216.134.52:80

183.91.3.63:80

139.59.61.215:443

185.80.172.199:80

77.74.78.80:443

153.229.219.1:443

113.203.238.130:80

120.51.34.254:80

116.202.10.123:8080

5.2.246.108:80

50.116.78.109:8080

103.80.51.61:8080

190.55.186.229:80

185.142.236.163:443

223.17.215.76:80
rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Emotet Payload 2 IoCs

    Detects Emotet payload in memory.

  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_5343ebf85b48060d70e2abe0e5e2e30f730263df12252e717b4a08e1561470b7_2020-11-17__175433.exe
    "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_5343ebf85b48060d70e2abe0e5e2e30f730263df12252e717b4a08e1561470b7_2020-11-17__175433.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:4764
  • \??\c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NgcSvc
    1⤵
      PID:2072
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
      1⤵
        PID:3508
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s NgcCtnrSvc
        1⤵
        • Modifies data under HKEY_USERS
        PID:3680

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4764-0-0x0000000000620000-0x000000000065D000-memory.dmp
        Filesize

        244KB

        Download
      • memory/4764-1-0x0000000002230000-0x000000000226C000-memory.dmp
        Filesize

        240KB

        Download