Analysis
-
max time kernel
135s -
max time network
136s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-11-2020 17:49
General
-
Target
emotet_exe_e2_6a5a173437f749bcdbf9cb68b10273db1c689ebf312122f1e05f800c4d24ba7a_2020-11-17__174948._exe.exe
-
Size
356KB
-
MD5
5fa2cd4354d4308df33488c316c46ffd
-
SHA1
220c07efaeb22d1b0e3c7e3479cb0cd7751bac64
-
SHA256
6a5a173437f749bcdbf9cb68b10273db1c689ebf312122f1e05f800c4d24ba7a
-
SHA512
12787e4633245a42bb51cb9385f985f7c2ed65d6c50b476727d109838651837bfbc03c97d7abd73fe577a497398bde9d81bcbb46d5bf1724b6ed8d8b7476f56a
Malware Config
Extracted
emotet
Epoch2
102.182.145.130:80
173.173.254.105:80
64.207.182.168:8080
51.89.199.141:8080
167.114.153.111:8080
173.63.222.65:80
218.147.193.146:80
59.125.219.109:443
172.104.97.173:8080
190.162.215.233:80
68.115.186.26:80
78.188.106.53:443
190.240.194.77:443
24.133.106.23:80
80.227.52.78:80
79.137.83.50:443
120.150.218.241:443
62.171.142.179:8080
194.4.58.192:7080
62.30.7.67:443
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet Payload 2 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_6a5a173437f749bcdbf9cb68b10273db1c689ebf312122f1e05f800c4d24ba7a_2020-11-17__174948._exe.exe"C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_6a5a173437f749bcdbf9cb68b10273db1c689ebf312122f1e05f800c4d24ba7a_2020-11-17__174948._exe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1056-0-0x00000000003C0000-0x00000000003F4000-memory.dmpFilesize
208KB
-
memory/1056-1-0x0000000000DA0000-0x0000000000DD3000-memory.dmpFilesize
204KB
-
memory/1636-2-0x000007FEF6930000-0x000007FEF6BAA000-memory.dmpFilesize
2.5MB