Overview

overview

10

Static

static

8b7c72262d...87.exe

windows7_x64

10

8b7c72262d...87.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    26-02-2022 07:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8b7c72262d30ac1b5f68f30f4b6c7d623968d91da08d32c2628a38074b23ab87.exe

  • Size

    476KB

  • MD5

    4b0eea4ab9295b29359ba65024a4de59

  • SHA1

    f739ff1be834c98e771db66a71aee5c76f1dd159

  • SHA256

    8b7c72262d30ac1b5f68f30f4b6c7d623968d91da08d32c2628a38074b23ab87

  • SHA512

    d10f7923d88d831ecba412551c9a3a0c33c8302dafcc147d09531a29eecadd1ecdb5d35499e825243cb2660ce0b4c1eba0af404de933b2b725ac4ad7e90be034

Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

68.44.137.144:443

82.223.70.24:8080

101.187.104.105:80

178.20.74.212:80

98.15.140.226:80

209.97.168.52:8080

74.208.45.104:8080

169.239.182.217:8080

176.111.60.55:8080

87.106.136.232:8080

46.105.131.69:443

93.51.50.171:8080

62.75.187.192:8080

185.94.252.104:443

190.160.53.126:80

50.116.86.205:8080

80.102.134.174:8080

110.145.77.103:80

113.160.130.116:8443

60.130.173.117:80
rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8b7c72262d30ac1b5f68f30f4b6c7d623968d91da08d32c2628a38074b23ab87.exe
    "C:\Users\Admin\AppData\Local\Temp\8b7c72262d30ac1b5f68f30f4b6c7d623968d91da08d32c2628a38074b23ab87.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/424-130-0x00000000005F0000-0x00000000005FC000-memory.dmp
    Filesize

    48KB

    Download
  • memory/424-133-0x00000000005E0000-0x00000000005E9000-memory.dmp
    Filesize

    36KB

    Download