Analysis

  • max time kernel
    141s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 19:14

General

  • Target

    4771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe

  • Size

    432KB

  • MD5

    596927e25ae8e3d16be6523372ccda76

  • SHA1

    609996bfb036d2a6ec9b434f96333bd877df8277

  • SHA256

    4771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3

  • SHA512

    ebfee2a7b9dcb39a2ae9762b7fc7a710aab9d154150d1fe21a81430f6730249c1b855365e260f6359693cba9ecfec45bf4717bac4467cea7a80412707a36b7b1

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

181.30.61.163:443

209.126.6.222:8080

5.153.250.14:8080

188.135.15.49:80

104.131.41.185:8080

178.250.54.208:8080

50.28.51.143:8080

170.81.48.2:80

87.106.46.107:8080

191.99.160.58:80

187.162.248.237:80

89.32.150.160:8080

46.28.111.142:7080

190.190.148.27:8080

190.115.18.139:8080

178.79.163.131:8080

73.213.208.163:80

219.92.8.17:8080

95.9.180.128:80

212.71.237.140:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M8

    suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M8

  • suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M9

    suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M9

  • Emotet Payload 2 IoCs

    Detects Emotet payload in memory.

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe
    "C:\Users\Admin\AppData\Local\Temp\4771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1956-130-0x0000000003BA0000-0x0000000003BAC000-memory.dmp
    Filesize

    48KB

  • memory/1956-134-0x0000000003A90000-0x0000000003A99000-memory.dmp
    Filesize

    36KB