967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638

General
Target

967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe

Filesize

584KB

Completed

13-09-2021 09:24

Score
10/10
MD5

430b59363f1aaebb0682c525d60e7bf6

SHA1

75afa9329b922fc49430c34ef37514f2f9e5802b

SHA256

967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638

Malware Config

Extracted

Family emotet
Botnet Epoch2
C2

94.49.254.194:80

212.51.142.238:8080

91.231.166.124:8080

162.241.92.219:8080

79.98.24.39:8080

109.117.53.230:443

78.189.165.52:8080

113.160.130.116:8443

121.124.124.40:7080

101.187.97.173:80

168.235.67.138:7080

104.131.44.150:8080

5.39.91.110:7080

139.59.60.244:8080

81.2.235.111:8080

116.203.32.252:8080

61.19.246.238:443

176.111.60.55:8080

190.55.181.54:443

108.48.41.69:80

203.153.216.189:7080

103.86.49.11:8080

104.236.246.93:8080

75.139.38.211:80

169.239.182.217:8080

62.75.141.82:80

93.156.165.186:80

73.11.153.178:8080

157.245.99.39:8080

41.60.200.34:80

50.116.86.205:8080

31.31.77.83:443

209.182.216.177:443

62.138.26.28:8080

95.213.236.64:8080

95.179.229.244:8080

209.141.54.221:8080

91.211.88.52:7080

173.91.22.41:80

222.214.218.37:4143

37.187.72.193:8080

137.59.187.107:8080

139.130.242.43:80

46.105.131.87:80

87.106.139.101:8080

200.55.243.138:8080

5.196.74.210:8080

79.7.158.208:80

185.94.252.104:443

104.131.11.150:443

rsa_pubkey.plain
Signatures 4

Filter: none

  • Emotet

    Description

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet Payload

    Description

    Detects Emotet payload in memory.

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/3952-116-0x0000000000620000-0x000000000062C000-memory.dmpemotet
  • Suspicious behavior: EnumeratesProcesses
    967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe

    Reported IOCs

    pidprocess
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
  • Suspicious use of SetWindowsHookEx
    967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe

    Reported IOCs

    pidprocess
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    3952967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
Processes 1
  • C:\Users\Admin\AppData\Local\Temp\967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe
    "C:\Users\Admin\AppData\Local\Temp\967865a88cfd3f1bec1a7e6271c68c787d2351e4173a0c98d77166a61b151638.exe"
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of SetWindowsHookEx
    PID:3952
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/3952-116-0x0000000000620000-0x000000000062C000-memory.dmp

                          • memory/3952-118-0x0000000000590000-0x00000000006DA000-memory.dmp