emotet | cb31aa64d622af367e69b61866890c93debe845d7a719b7bd7fc2de765de08f3

Analysis

max time kernel
138s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
21-05-2022 18:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb31aa64d622af367e69b61866890c93debe845d7a719b7bd7fc2de765de08f3.exe
Size

176KB
MD5

804223b2ff7251869bbf77cd700b7870
SHA1

e3a7a553209483ed16a4dcb4af18db54b891c20f
SHA256

cb31aa64d622af367e69b61866890c93debe845d7a719b7bd7fc2de765de08f3
SHA512

82d8212203391f536fbc70153b309e7b2e8b64c84bb64b18a80893afc88436d79703152cbef7a199945693a2246c66d98458ef501e90c838a597fe06fdff7c20

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

70.121.172.89:80

116.202.234.183:8080

69.30.203.214:8080

185.94.252.104:443

64.183.73.122:80

190.55.181.54:443

37.70.8.161:80

174.137.65.18:80

203.153.216.189:7080

109.116.214.124:443

93.51.50.171:8080

190.160.53.126:80

222.214.218.37:4143

87.106.136.232:8080

113.160.130.116:8443

174.102.48.180:80

79.98.24.39:8080

189.212.199.126:443

89.186.91.200:443

24.233.112.152:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet Payload 2 IoCs

Detects Emotet payload in memory.

trojan banker

Processes:

resource	yara_rule
behavioral2/memory/2832-130-0x0000000000AD0000-0x0000000000ADC000-memory.dmp	emotet
behavioral2/memory/2832-134-0x0000000000AC0000-0x0000000000AC9000-memory.dmp	emotet

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

cb31aa64d622af367e69b61866890c93debe845d7a719b7bd7fc2de765de08f3.exe

pid	process
2832	cb31aa64d622af367e69b61866890c93debe845d7a719b7bd7fc2de765de08f3.exe
2832	cb31aa64d622af367e69b61866890c93debe845d7a719b7bd7fc2de765de08f3.exe
2832	cb31aa64d622af367e69b61866890c93debe845d7a719b7bd7fc2de765de08f3.exe
2832	cb31aa64d622af367e69b61866890c93debe845d7a719b7bd7fc2de765de08f3.exe
2832	cb31aa64d622af367e69b61866890c93debe845d7a719b7bd7fc2de765de08f3.exe
2832	cb31aa64d622af367e69b61866890c93debe845d7a719b7bd7fc2de765de08f3.exe
2832	cb31aa64d622af367e69b61866890c93debe845d7a719b7bd7fc2de765de08f3.exe
2832	cb31aa64d622af367e69b61866890c93debe845d7a719b7bd7fc2de765de08f3.exe
2832	cb31aa64d622af367e69b61866890c93debe845d7a719b7bd7fc2de765de08f3.exe
2832	cb31aa64d622af367e69b61866890c93debe845d7a719b7bd7fc2de765de08f3.exe
2832	cb31aa64d622af367e69b61866890c93debe845d7a719b7bd7fc2de765de08f3.exe
2832	cb31aa64d622af367e69b61866890c93debe845d7a719b7bd7fc2de765de08f3.exe
2832	cb31aa64d622af367e69b61866890c93debe845d7a719b7bd7fc2de765de08f3.exe
2832	cb31aa64d622af367e69b61866890c93debe845d7a719b7bd7fc2de765de08f3.exe
2832	cb31aa64d622af367e69b61866890c93debe845d7a719b7bd7fc2de765de08f3.exe
2832	cb31aa64d622af367e69b61866890c93debe845d7a719b7bd7fc2de765de08f3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

cb31aa64d622af367e69b61866890c93debe845d7a719b7bd7fc2de765de08f3.exe

pid	process
2832	cb31aa64d622af367e69b61866890c93debe845d7a719b7bd7fc2de765de08f3.exe
2832	cb31aa64d622af367e69b61866890c93debe845d7a719b7bd7fc2de765de08f3.exe

C:\Users\Admin\AppData\Local\Temp\cb31aa64d622af367e69b61866890c93debe845d7a719b7bd7fc2de765de08f3.exe
"C:\Users\Admin\AppData\Local\Temp\cb31aa64d622af367e69b61866890c93debe845d7a719b7bd7fc2de765de08f3.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2832-130-0x0000000000AD0000-0x0000000000ADC000-memory.dmp

Filesize
48KB

Download
memory/2832-134-0x0000000000AC0000-0x0000000000AC9000-memory.dmp

Filesize
36KB

Download