Analysis
-
max time kernel
120s -
max time network
134s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-11-2020 17:49
General
-
Target
emotet_exe_e2_8c4ba5f8842d9cdb4ae65d88582dad9f78034a21551c3adb302e7d0fcb46207f_2020-11-17__174949._exe.exe
-
Size
356KB
-
MD5
1679654a6e9caa88c08640fc39e20fa5
-
SHA1
dfe51ab41d9721d1b774285fb01cc3606a4035a0
-
SHA256
8c4ba5f8842d9cdb4ae65d88582dad9f78034a21551c3adb302e7d0fcb46207f
-
SHA512
8c429bc075a356b97793b43a5b0d3ee62ec7438a94de7b90e14fe7e68ad16fef429f43aed9ffe2b1543cd20e46b8b41c702c7ef9f02b156b15f9c4c6ec94be98
Malware Config
Extracted
emotet
Epoch2
102.182.145.130:80
173.173.254.105:80
64.207.182.168:8080
51.89.199.141:8080
167.114.153.111:8080
173.63.222.65:80
218.147.193.146:80
59.125.219.109:443
172.104.97.173:8080
190.162.215.233:80
68.115.186.26:80
78.188.106.53:443
190.240.194.77:443
24.133.106.23:80
80.227.52.78:80
79.137.83.50:443
120.150.218.241:443
62.171.142.179:8080
194.4.58.192:7080
62.30.7.67:443
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet Payload 2 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_8c4ba5f8842d9cdb4ae65d88582dad9f78034a21551c3adb302e7d0fcb46207f_2020-11-17__174949._exe.exe"C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_8c4ba5f8842d9cdb4ae65d88582dad9f78034a21551c3adb302e7d0fcb46207f_2020-11-17__174949._exe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/932-0-0x0000000002AC0000-0x0000000002AF4000-memory.dmpFilesize
208KB
-
memory/932-1-0x0000000002B00000-0x0000000002B33000-memory.dmpFilesize
204KB
-
memory/1168-2-0x000007FEF7800000-0x000007FEF7A7A000-memory.dmpFilesize
2.5MB