emotet | 0c8f02260b058f477ed9f04d9e70cef6d96e1ee3f651533317d0fbc312867fa8

Analysis

max time kernel
130s
max time network
144s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21/11/2024, 00:09 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c8f02260b058f477ed9f04d9e70cef6d96e1ee3f651533317d0fbc312867fa8.exe
Size

300KB
MD5

6c6c51176a30318e5bf3e84ba092c525
SHA1

88a64dd99ca59bccef963cc63df0e5fc4f277dab
SHA256

0c8f02260b058f477ed9f04d9e70cef6d96e1ee3f651533317d0fbc312867fa8
SHA512

dc5f331315ecb5b3144e7df1300a8e77e061c3703edd2370402ba0b0b7830b678739d843582a1cda70203caecb7516e98648b9cc4fc3a5f9d7e9d8b6f6a3af2b
SSDEEP

6144:4BW3qfvKcJA6paL++acj5205qvVuV7gQtKETSUR:4U3qfzu6pKQcUOgXK

Score

10^/10

emotet epoch3 banker discovery trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

92.24.51.238:80

139.99.157.213:8080

188.166.25.84:8080

81.214.253.80:443

5.79.70.250:8080

41.185.29.128:8080

181.164.110.7:80

177.37.81.212:443

203.153.216.178:7080

178.33.167.120:8080

77.74.78.80:443

37.70.131.107:80

190.164.75.175:80

75.127.14.170:8080

78.188.170.128:80

113.161.148.81:80

105.209.235.113:8080

177.144.130.105:443

81.17.93.134:80

181.134.9.162:80

rsa_pubkey.plain

1
-----BEGIN PUBLIC KEY-----
2
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAM/TXLLvX91I6dVMYe+T1PPO6mpcg7OJ
3
cMl9o/g4nUhZOp8fAAmQl8XMXeGvDhZXTyX1AXf401iPFui0RB6glhl/7/djvi7j
4
l32lAhyBANpKGty8xf3J5kGwwClnG/CXHQIDAQAB
5
-----END PUBLIC KEY-----

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet

Emotet payload 3 IoCs

Detects Emotet payload in memory.

trojan banker

resource	yara_rule
behavioral1/memory/2200-4-0x00000000002B0000-0x00000000002B9000-memory.dmp	emotet
behavioral1/memory/2200-0-0x00000000002C0000-0x00000000002CC000-memory.dmp	emotet
behavioral1/memory/2200-5-0x00000000002C0000-0x00000000002CC000-memory.dmp	emotet

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0c8f02260b058f477ed9f04d9e70cef6d96e1ee3f651533317d0fbc312867fa8.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2200	0c8f02260b058f477ed9f04d9e70cef6d96e1ee3f651533317d0fbc312867fa8.exe
2200	0c8f02260b058f477ed9f04d9e70cef6d96e1ee3f651533317d0fbc312867fa8.exe
2200	0c8f02260b058f477ed9f04d9e70cef6d96e1ee3f651533317d0fbc312867fa8.exe
2200	0c8f02260b058f477ed9f04d9e70cef6d96e1ee3f651533317d0fbc312867fa8.exe
2200	0c8f02260b058f477ed9f04d9e70cef6d96e1ee3f651533317d0fbc312867fa8.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2200	0c8f02260b058f477ed9f04d9e70cef6d96e1ee3f651533317d0fbc312867fa8.exe
2200	0c8f02260b058f477ed9f04d9e70cef6d96e1ee3f651533317d0fbc312867fa8.exe

C:\Users\Admin\AppData\Local\Temp\0c8f02260b058f477ed9f04d9e70cef6d96e1ee3f651533317d0fbc312867fa8.exe
"C:\Users\Admin\AppData\Local\Temp\0c8f02260b058f477ed9f04d9e70cef6d96e1ee3f651533317d0fbc312867fa8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2200

Network

No results found

92.24.51.238:80

0c8f02260b058f477ed9f04d9e70cef6d96e1ee3f651533317d0fbc312867fa8.exe

152 B
3
92.24.51.238:80

0c8f02260b058f477ed9f04d9e70cef6d96e1ee3f651533317d0fbc312867fa8.exe

152 B
3
139.99.157.213:8080

0c8f02260b058f477ed9f04d9e70cef6d96e1ee3f651533317d0fbc312867fa8.exe

152 B
3
139.99.157.213:8080

0c8f02260b058f477ed9f04d9e70cef6d96e1ee3f651533317d0fbc312867fa8.exe

152 B
3
188.166.25.84:8080

0c8f02260b058f477ed9f04d9e70cef6d96e1ee3f651533317d0fbc312867fa8.exe

152 B
120 B
3
3
188.166.25.84:8080

0c8f02260b058f477ed9f04d9e70cef6d96e1ee3f651533317d0fbc312867fa8.exe

152 B
40 B
3
1
81.214.253.80:443

0c8f02260b058f477ed9f04d9e70cef6d96e1ee3f651533317d0fbc312867fa8.exe

152 B
3

No results found

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2200-4-0x00000000002B0000-0x00000000002B9000-memory.dmp

Filesize
36KB

Download
memory/2200-0-0x00000000002C0000-0x00000000002CC000-memory.dmp

Filesize
48KB

Download
memory/2200-5-0x00000000002C0000-0x00000000002CC000-memory.dmp

Filesize
48KB

Download