General
Target

4771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe

Filesize

432KB

Completed

21-05-2022 19:17

Task

behavioral2

Score
10/10
MD5

596927e25ae8e3d16be6523372ccda76

SHA1

609996bfb036d2a6ec9b434f96333bd877df8277

SHA256

4771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3

SHA512

ebfee2a7b9dcb39a2ae9762b7fc7a710aab9d154150d1fe21a81430f6730249c1b855365e260f6359693cba9ecfec45bf4717bac4467cea7a80412707a36b7b1

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

181.30.61.163:443

209.126.6.222:8080

5.153.250.14:8080

188.135.15.49:80

104.131.41.185:8080

178.250.54.208:8080

50.28.51.143:8080

170.81.48.2:80

87.106.46.107:8080

191.99.160.58:80

187.162.248.237:80

89.32.150.160:8080

46.28.111.142:7080

190.190.148.27:8080

190.115.18.139:8080

178.79.163.131:8080

73.213.208.163:80

219.92.8.17:8080

95.9.180.128:80

212.71.237.140:8080

82.196.15.205:8080

111.67.12.221:8080

24.135.198.218:80

202.4.57.96:80

61.92.159.208:8080

80.249.176.206:80

77.90.136.129:8080

81.129.198.57:80

58.171.153.81:80

217.13.106.14:8080

24.148.98.177:80

51.255.165.160:8080

190.6.193.152:8080

149.62.173.247:8080

94.206.45.18:80

137.74.106.111:7080

190.195.129.227:8090

85.109.159.61:443

207.144.103.227:80

91.219.169.180:80

217.199.160.224:7080

104.131.103.37:8080

83.169.21.32:7080

82.163.245.38:80

204.225.249.100:7080

152.169.22.67:80

45.161.242.102:80

65.36.62.20:80

185.94.252.27:443

116.125.120.88:443

rsa_pubkey.plain
Signatures 6

Filter: none

  • Emotet

    Description

    Emotet is a trojan that is primarily spread through spam emails.

  • suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M8

    Description

    suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M8

    Tags

  • suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M9

    Description

    suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M9

    Tags

  • Emotet Payload

    Description

    Detects Emotet payload in memory.

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/1956-130-0x0000000003BA0000-0x0000000003BAC000-memory.dmpemotet
    behavioral2/memory/1956-134-0x0000000003A90000-0x0000000003A99000-memory.dmpemotet
  • Suspicious behavior: EnumeratesProcesses
    4771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe

    Reported IOCs

    pidprocess
    19564771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe
    19564771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe
    19564771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe
    19564771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe
    19564771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe
    19564771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe
    19564771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe
    19564771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe
    19564771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe
    19564771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe
    19564771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe
    19564771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe
    19564771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe
    19564771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe
    19564771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe
    19564771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe
  • Suspicious use of SetWindowsHookEx
    4771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe

    Reported IOCs

    pidprocess
    19564771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe
    19564771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe
Processes 1
  • C:\Users\Admin\AppData\Local\Temp\4771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe
    "C:\Users\Admin\AppData\Local\Temp\4771704ad0deeb7f652c78407badc34b64eaeaaf78aa07c4abfddc008499adc3.exe"
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of SetWindowsHookEx
    PID:1956
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/1956-130-0x0000000003BA0000-0x0000000003BAC000-memory.dmp

                          • memory/1956-134-0x0000000003A90000-0x0000000003A99000-memory.dmp