Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
29/05/2026, 02:37
General
- Target c529bf53cb07a282ca2590f580f7dada1e409d94ff932570304cd5af662da7d0.exe
- Size 656KB
- Sample260529-c4cnlsbs4m
- SHA256 c529bf53cb07a282ca2590f580f7dada1e409d94ff932570304cd5af662da7d0
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch1
C2
-
98.13.75.196:80
-
91.121.54.71:8080
-
209.236.123.42:8080
-
89.32.150.160:8080
-
212.71.237.140:8080
-
51.255.165.160:8080
-
188.135.15.49:80
-
189.2.177.210:443
-
45.161.242.102:80
-
72.167.223.217:8080
-
77.238.212.227:80
-
186.70.127.199:8090
-
45.33.77.42:8080
-
87.106.46.107:8080
-
172.104.169.32:8080
-
187.162.248.237:80
-
190.163.31.26:80
-
95.9.180.128:80
-
71.197.211.156:80
-
91.219.169.180:80
rsa_pubkey.plain
Signatures
- Family: Emotet
Emotet is a trojan that is primarily spread through spam emails.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c529bf53cb07a282ca2590f580f7dada1e409d94ff932570304cd5af662da7d0.exe"C:\Users\Admin\AppData\Local\Temp\c529bf53cb07a282ca2590f580f7dada1e409d94ff932570304cd5af662da7d0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5904-1-0x0000000002350000-0x000000000235C000-memory.dmp
memory/5904-0-0x0000000002340000-0x0000000002349000-memory.dmp
memory/5904-5-0x0000000002350000-0x000000000235C000-memory.dmp