Analysis
-
max time kernel
116s -
max time network
133s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-11-2020 17:49
General
-
Target
emotet_exe_e2_440e883114d07c7101c029ff1d675cc1a174badabb01822ef53bf2d16b024eb6_2020-11-17__174954._exe.exe
-
Size
568KB
-
MD5
584047ef86f9101e9fcdd8ce3c903e8e
-
SHA1
61b963216c5e0a2c06d7c2ced62d53d3abb4aa5d
-
SHA256
440e883114d07c7101c029ff1d675cc1a174badabb01822ef53bf2d16b024eb6
-
SHA512
37ecc5255eb0ce02521f0a2a489e115382d963c3c415bb8c2fe8997b7c73e6e8361f8282bf06fe275761b0703da5b9f4f805b800c2d5cb5ad2e9462634bc4cf1
Malware Config
Extracted
emotet
Epoch2
88.153.35.32:80
107.170.146.252:8080
173.212.214.235:7080
167.114.153.111:8080
202.141.243.254:443
75.143.247.51:80
85.105.111.166:80
216.139.123.119:80
113.61.66.94:80
162.241.140.129:8080
190.12.119.180:443
2.58.16.89:8080
91.211.88.52:7080
93.147.212.206:80
71.15.245.148:8080
157.245.99.39:8080
27.114.9.93:80
50.91.114.38:80
174.106.122.139:80
47.36.140.164:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet Payload 1 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_440e883114d07c7101c029ff1d675cc1a174badabb01822ef53bf2d16b024eb6_2020-11-17__174954._exe.exe"C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_440e883114d07c7101c029ff1d675cc1a174badabb01822ef53bf2d16b024eb6_2020-11-17__174954._exe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/844-2-0x0000000000000000-mapping.dmp
-
memory/1632-4-0x000007FEF79D0000-0x000007FEF7C4A000-memory.dmpFilesize
2.5MB
-
memory/1816-3-0x0000000000540000-0x0000000000550000-memory.dmpFilesize
64KB