Analysis
- max time kernel
138s - max time network
150s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
31/08/2022, 04:02
General
- Target HEUR-Trojan-Banker.Win32.Emotet.pef-d370f2b103598ca26688560b98edb8df2079b769d2bb17ff112eb10a9bfa26fe.exe
- Size 640KB
- Sample220831-elt62sabe4
- SHA256 d370f2b103598ca26688560b98edb8df2079b769d2bb17ff112eb10a9bfa26fe
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch2
C2
-
82.225.49.121:80
-
120.138.30.150:8080
-
139.59.67.118:443
-
94.23.216.33:80
-
203.117.253.142:80
-
139.99.158.11:443
-
87.106.139.101:8080
-
190.160.53.126:80
-
5.39.91.110:7080
-
107.5.122.110:80
-
174.102.48.180:443
-
194.187.133.160:443
-
153.177.101.120:443
-
104.236.246.93:8080
-
78.24.219.147:8080
-
94.23.237.171:443
-
85.66.181.138:80
-
157.245.99.39:8080
-
201.173.217.124:443
-
91.211.88.52:7080
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Emotet payload 3 IoCs
Detects Emotet payload in memory.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Banker.Win32.Emotet.pef-d370f2b103598ca26688560b98edb8df2079b769d2bb17ff112eb10a9bfa26fe.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Banker.Win32.Emotet.pef-d370f2b103598ca26688560b98edb8df2079b769d2bb17ff112eb10a9bfa26fe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2020-54-0x00000000756B1000-0x00000000756B3000-memory.dmp
memory/2020-55-0x0000000000360000-0x0000000000372000-memory.dmp
memory/2020-59-0x0000000000270000-0x0000000000280000-memory.dmp
memory/2020-62-0x0000000000250000-0x000000000025F000-memory.dmp