emotet | 6ce6049e28e4bd8deb29ede3013c13c55c407d30fa82d02d34d594853be67195

Analysis

max time kernel
135s
max time network
175s
platform
windows7_x64
resource
win7v20210408
submitted
14-09-2021 06:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ce6049e28e4bd8deb29ede3013c13c55c407d30fa82d02d34d594853be67195.exe
Size

424KB
MD5

0783688bfe061c4e8f34484af0376c0e
SHA1

eabce7ebeac060df0a4ca9ca48667f899928844e
SHA256

6ce6049e28e4bd8deb29ede3013c13c55c407d30fa82d02d34d594853be67195
SHA512

9345331052d7d6732e635f1f36e93e7201a944745bd9628db4f274d054eea9e75509d01682e7eea0c2732ba2bbd3cc853a590bb42b1417beabfcceb83a48dc79

Score

10^/10

emotet epoch3 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

201.212.78.182:80

74.207.230.187:8080

81.214.253.80:443

181.167.35.84:80

195.201.56.70:8080

37.46.129.215:8080

190.251.235.239:80

192.163.221.191:8080

177.0.241.28:80

41.185.29.128:8080

46.105.131.68:8080

78.188.170.128:80

45.118.136.92:8080

163.172.107.70:8080

37.70.131.107:80

177.144.130.105:443

181.230.65.232:80

192.210.217.94:8080

181.164.110.7:80

50.116.78.109:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet Payload 2 IoCs

Detects Emotet payload in memory.

Processes:

resource	yara_rule
behavioral1/memory/1928-60-0x00000000003A0000-0x00000000003AC000-memory.dmp	emotet
behavioral1/memory/1928-61-0x00000000002D0000-0x00000000002D9000-memory.dmp	emotet

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

6ce6049e28e4bd8deb29ede3013c13c55c407d30fa82d02d34d594853be67195.exe

pid	process
1928	6ce6049e28e4bd8deb29ede3013c13c55c407d30fa82d02d34d594853be67195.exe
1928	6ce6049e28e4bd8deb29ede3013c13c55c407d30fa82d02d34d594853be67195.exe
1928	6ce6049e28e4bd8deb29ede3013c13c55c407d30fa82d02d34d594853be67195.exe
1928	6ce6049e28e4bd8deb29ede3013c13c55c407d30fa82d02d34d594853be67195.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

6ce6049e28e4bd8deb29ede3013c13c55c407d30fa82d02d34d594853be67195.exe

pid	process
1928	6ce6049e28e4bd8deb29ede3013c13c55c407d30fa82d02d34d594853be67195.exe
1928	6ce6049e28e4bd8deb29ede3013c13c55c407d30fa82d02d34d594853be67195.exe

C:\Users\Admin\AppData\Local\Temp\6ce6049e28e4bd8deb29ede3013c13c55c407d30fa82d02d34d594853be67195.exe
"C:\Users\Admin\AppData\Local\Temp\6ce6049e28e4bd8deb29ede3013c13c55c407d30fa82d02d34d594853be67195.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1928-59-0x0000000076691000-0x0000000076693000-memory.dmp

Filesize
8KB

Download
memory/1928-60-0x00000000003A0000-0x00000000003AC000-memory.dmp

Filesize
48KB

Download
memory/1928-61-0x00000000002D0000-0x00000000002D9000-memory.dmp

Filesize
36KB

Download