Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-11-2020 15:12
General
-
Target
a47bca92dbf3ef4d04a855a6fc4738d5.exe
-
Size
431KB
-
MD5
a3861627819c1f96cb49d744f29fa133
-
SHA1
f2a9e814df080f939b49b332106ee528b0bf874c
-
SHA256
cf6b9926592640d4b57cc72612a16a8a9247b9097f9f559db40e8d26e8688361
-
SHA512
08b8618aef12ecc7a6eb2c5d4b467941ea8226247172cd92ec55be1f966c78f867eb110c112a35b39c6d8b76efcd415e5aeb0128a64971c5f30413efa696af9b
Malware Config
Extracted
emotet
Epoch2
184.180.181.202:80
169.50.76.149:8080
162.241.140.129:8080
104.131.123.136:443
194.187.133.160:443
71.15.245.148:8080
37.139.21.175:8080
104.131.11.150:443
118.83.154.64:443
24.137.76.62:80
79.137.83.50:443
69.206.132.149:80
110.142.236.207:80
123.176.25.234:80
120.150.60.189:80
209.54.13.14:80
95.213.236.64:8080
209.141.54.221:8080
96.245.227.43:80
87.106.139.101:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet Payload 2 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a47bca92dbf3ef4d04a855a6fc4738d5.exe"C:\Users\Admin\AppData\Local\Temp\a47bca92dbf3ef4d04a855a6fc4738d5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/752-0-0x0000000000310000-0x000000000032A000-memory.dmpFilesize
104KB
-
memory/752-1-0x00000000003C0000-0x00000000003D9000-memory.dmpFilesize
100KB
-
memory/1224-2-0x000007FEF6350000-0x000007FEF65CA000-memory.dmpFilesize
2.5MB