Analysis
-
max time kernel
122s -
max time network
148s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-11-2020 19:21
General
-
Target
emotet_exe_e1_0f5683542260cad3335d0aba0eef9c07691d357d39c36c0195695faad410af3f_2020-11-17__192121.exe
-
Size
492KB
-
MD5
fcaa3a5bcb20281012d58b6b2274d3c7
-
SHA1
2e9adff3bcf096a384bed776d001849cb3352d42
-
SHA256
0f5683542260cad3335d0aba0eef9c07691d357d39c36c0195695faad410af3f
-
SHA512
9dc44c5eef12cfd65601083689853c87a16b3f108a6bf092a021fc84252d4f88e85ef7415a7b9668c4202d99a76b6d2875da3b3a56f07aff01cf01e4f450a84e
Malware Config
Extracted
emotet
Epoch1
197.245.25.228:80
98.103.204.12:443
59.148.253.194:8080
173.212.197.71:8080
87.106.46.107:8080
50.28.51.143:8080
177.73.0.98:443
213.197.182.158:8080
185.94.252.12:80
189.223.16.99:80
5.189.178.202:8080
186.103.141.250:443
181.129.96.162:8080
190.101.156.139:80
46.105.114.137:8080
51.15.7.145:80
98.13.75.196:80
202.134.4.210:7080
104.131.41.185:8080
181.123.6.86:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet Payload 2 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_0f5683542260cad3335d0aba0eef9c07691d357d39c36c0195695faad410af3f_2020-11-17__192121.exe"C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_0f5683542260cad3335d0aba0eef9c07691d357d39c36c0195695faad410af3f_2020-11-17__192121.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/272-2-0x000007FEF6460000-0x000007FEF66DA000-memory.dmpFilesize
2.5MB
-
memory/1068-0-0x0000000001E10000-0x0000000001E43000-memory.dmpFilesize
204KB
-
memory/1068-1-0x0000000001E50000-0x0000000001E81000-memory.dmpFilesize
196KB