emotet | 06c6442d5bb110140ac1cdbcf1be52388441b9a0750d59b743acc6b52d19582b

Analysis

max time kernel
141s
max time network
147s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13-03-2023 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

task1.exe
Size

188KB
MD5

2ba73d2d47cf2d388446b781613b7eff
SHA1

c75c7eb4814835388881d1b4c2db67e64a023e1e
SHA256

06c6442d5bb110140ac1cdbcf1be52388441b9a0750d59b743acc6b52d19582b
SHA512

667ddc16765d8c3c3596bb734174862db1f2ac24037c361a2e37ec9824c35a8926728400025d62c62c361b1b1e1a9d1e3b4c38c2c5989eee832e083481e50caa
SSDEEP

3072:0O7Mn+0UNzRqN7GZDA62KrcNaQV/7T9kSjkltZJmHcPz6HEJE:kUGJeD8HVOSqBmHbk

Score

10^/10

emotet epoch2 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

74.219.172.26:80

134.209.36.254:8080

104.156.59.7:8080

120.138.30.150:8080

194.187.133.160:443

104.236.246.93:8080

74.208.45.104:8080

78.187.156.31:80

187.161.206.24:80

94.23.216.33:80

172.91.208.86:80

91.211.88.52:7080

50.91.114.38:80

200.123.150.89:443

121.124.124.40:7080

62.75.141.82:80

5.196.74.210:8080

24.137.76.62:80

85.105.205.77:8080

139.130.242.43:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet payload 3 IoCs

Detects Emotet payload in memory.

trojan banker

Processes:

resource	yara_rule
behavioral1/memory/1232-58-0x0000000000380000-0x0000000000390000-memory.dmp	emotet
behavioral1/memory/1232-54-0x0000000000350000-0x0000000000362000-memory.dmp	emotet
behavioral1/memory/1232-62-0x0000000000240000-0x000000000024F000-memory.dmp	emotet

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

task1.exe

pid process

1232 task1.exe
1232 task1.exe
1232 task1.exe
1232 task1.exe

pid	process
1232	task1.exe
1232	task1.exe
1232	task1.exe
1232	task1.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1524	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1524	AUDIODG.EXE
Token: 33	1524	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1524	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

task1.exe

pid process

1232 task1.exe
1232 task1.exe

pid	process
1232	task1.exe
1232	task1.exe

C:\Users\Admin\AppData\Local\Temp\task1.exe
"C:\Users\Admin\AppData\Local\Temp\task1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1232

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:552

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x558
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1232-58-0x0000000000380000-0x0000000000390000-memory.dmp

Filesize
64KB

Download
memory/1232-54-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/1232-62-0x0000000000240000-0x000000000024F000-memory.dmp

Filesize
60KB

Download