Analysis
- max time kernel
42s - max time network
152s - platform
windows7_x64 - resource
win7-20220414-en - submitted
22/04/2022, 15:55
General
- Target emotet_exe_e5_b63af8852e719d6f55bce0bcd53553a2da3302a38c256b739b063f2ef3a3463e_2022-04-22__155431.dll
- Size 728KB
- Sample220422-tcsdesaacm
- SHA256 b63af8852e719d6f55bce0bcd53553a2da3302a38c256b739b063f2ef3a3463e
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch5
C2
-
68.183.91.111:8080
-
164.52.194.45:8080
-
202.29.239.162:443
-
54.38.143.246:7080
-
54.37.106.167:8080
-
185.148.168.220:8080
-
196.44.98.190:8080
-
175.126.176.79:8080
-
207.148.81.119:8080
-
37.59.209.141:8080
-
103.42.58.120:7080
-
54.37.228.122:443
-
68.183.93.250:443
-
66.42.57.149:443
-
45.71.195.104:8080
-
78.47.204.80:443
-
128.199.192.135:8080
-
195.154.146.35:443
-
118.98.72.86:443
-
116.124.128.206:8080
eck1.plain
ecs1.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
- Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_b63af8852e719d6f55bce0bcd53553a2da3302a38c256b739b063f2ef3a3463e_2022-04-22__155431.dll1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2020-54-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp
memory/2020-55-0x0000000180000000-0x0000000180029000-memory.dmp