Overview

overview

10

Static

static

3

6f6419dd88...1d.exe

windows7-x64

10

6f6419dd88...1d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-08-2023 07:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6f6419dd883d4cc7508737d32fc61810be2edccdc8799bce0f3a1fec8a7d951d.exe

  • Size

    296KB

  • MD5

    47e3f5eddc841a7c2830032e9d1ef085

  • SHA1

    bb69a0240b05fe0168ff527f19a9289bf958b79e

  • SHA256

    6f6419dd883d4cc7508737d32fc61810be2edccdc8799bce0f3a1fec8a7d951d

  • SHA512

    184df76b83d7b6a83d1f9fa6be2931e5efd76b0637c4b5bdac71f98bbedc9fec6d592ebb982f9c24dceaa5a4b5293a0b4b9c8b9424eb6ecc4b878c273ebc3159

  • SSDEEP

    6144:DBvNm3SpFyFCMCgjMtXGVT3gnkPCGIQ7md8eeGt1IsE:DBvNm3SpFLMC7tMTck6GF7mdveGtA

Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

71.208.216.10:80

212.51.142.238:8080

5.39.91.110:7080

109.74.5.95:8080

121.124.124.40:7080

139.130.242.43:80

162.241.92.219:8080

93.156.165.186:80

203.153.216.189:7080

169.239.182.217:8080

78.189.165.52:8080

37.187.72.193:8080

110.145.77.103:80

190.144.18.198:80

209.182.216.177:443

74.208.45.104:8080

209.141.54.221:8080

190.160.53.126:80

87.106.139.101:8080

176.111.60.55:8080
rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

    trojanbanker
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f6419dd883d4cc7508737d32fc61810be2edccdc8799bce0f3a1fec8a7d951d.exe
    "C:\Users\Admin\AppData\Local\Temp\6f6419dd883d4cc7508737d32fc61810be2edccdc8799bce0f3a1fec8a7d951d.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3392-134-0x0000000002220000-0x0000000002229000-memory.dmp
    Filesize

    36KB

    Download
  • memory/3392-133-0x00000000024B0000-0x00000000024BC000-memory.dmp
    Filesize

    48KB

    Download
  • memory/3392-138-0x00000000024B0000-0x00000000024BC000-memory.dmp
    Filesize

    48KB

    Download
  • memory/3392-139-0x0000000002210000-0x0000000002218000-memory.dmp
    Filesize

    32KB

    Download
  • memory/3392-140-0x00000000025E0000-0x00000000026D1000-memory.dmp
    Filesize

    964KB

    Download