Detections

Suricata:

Emotet

Analysis

Category Package Started Completed Duration Log
PCAP 2020-04-12 21:49:10 2020-04-12 21:49:10 0 seconds Show Log

    


Signatures

CAPE detected the Emotet malware family
Created network traffic indicative of malicious activity
signature: ET MALWARE Win32/Emotet CnC Activity (POST) M8
signature: ET CNC Feodo Tracker Reported CnC Server group 3

Hosts

No hosts contacted.

DNS

No domains contacted.


Sorry! No behavior.

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

No UDP connections recorded.

DNS

No domains contacted.

HTTP Requests

No HTTP requests performed.

SMTP traffic

No SMTP traffic performed.

IRC traffic

No IRC requests performed.

ICMP traffic

No ICMP traffic performed.

CIF Results

No CIF Results

Suricata Alerts

Timestamp Source IP Source Port Destination IP Destination Port Protocol GID SID REV Signature Category Severity
2020-04-12 21:34:53.558 192.168.122.101 [VT] 49671 124.150.175.133 [VT] 8080 TCP 1 2404302 5669 ET CNC Feodo Tracker Reported CnC Server group 3 A Network Trojan was detected 1
2020-04-12 21:34:56.033 192.168.122.101 [VT] 49671 124.150.175.133 [VT] 8080 TCP 1 2029380 4 ET MALWARE Win32/Emotet CnC Activity (POST) M8 Malware Command and Control Activity Detected 1
2020-04-12 21:35:03.062 192.168.122.101 [VT] 49671 124.150.175.133 [VT] 8080 TCP 1 2029380 4 ET MALWARE Win32/Emotet CnC Activity (POST) M8 Malware Command and Control Activity Detected 1
2020-04-12 21:35:15.959 192.168.122.101 [VT] 49674 124.150.175.133 [VT] 8080 TCP 1 2029380 4 ET MALWARE Win32/Emotet CnC Activity (POST) M8 Malware Command and Control Activity Detected 1

Suricata TLS

No Suricata TLS

Suricata HTTP

Timestamp Source IP Source Port Destination IP Destination Port Method Status Hostname URI Content Type User Agent Referrer Length
2020-04-12 21:35:01.010 192.168.122.101 [VT] 49671 124.150.175.133 [VT] 8080 200 124.150.175.133 [VT] /Y5g54wTlqQvg/iNgbvRbS93PqFR8dkBz/Q1nh2/8d9HzHJtKM/2v2kbVa7wptSn/ text/html Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) http://124.150.175.133/Y5g54wTlqQvg/iNgbvRbS93PqFR8dkBz/Q1nh2/8d9HzHJtKM/2v2kbVa7wptSn/ 163684
2020-04-12 21:35:02.444 192.168.122.101 [VT] 49672 104.236.52.89 [VT] 8080 200 104.236.52.89 [VT] /SWeh1JYTtLQ text/html Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) http://104.236.52.89/SWeh1JYTtLQ 148
2020-04-12 21:35:07.256 192.168.122.101 [VT] 49673 104.236.52.89 [VT] 8080 200 104.236.52.89 [VT] /NOYJuuBfUNC0Lo text/html Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) http://104.236.52.89/NOYJuuBfUNC0Lo 148
2020-04-12 21:35:08.997 192.168.122.101 [VT] 49671 124.150.175.133 [VT] 8080 200 124.150.175.133 [VT] /VPONFYfqeRn7v/gPzJG2j7/RvtftvmgpUEEvO/H0Zv8XuyO3BrFwJbl/ text/html Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) http://124.150.175.133/VPONFYfqeRn7v/gPzJG2j7/RvtftvmgpUEEvO/H0Zv8XuyO3BrFwJbl/ 272964
2020-04-12 21:35:15.959 192.168.122.101 [VT] 49674 124.150.175.133 [VT] 8080 200 124.150.175.133 [VT] /iUA9/sgp7YFOye5wsi/amKdUW/1IDwEwSQhxO3W/Fcpl35l/ text/html Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) http://124.150.175.133/iUA9/sgp7YFOye5wsi/amKdUW/1IDwEwSQhxO3W/Fcpl35l/ 132
Sorry! No dropped Suricata Extracted files.

JA3

No JA3 hashes found.

Sorry! No dropped files.
Sorry! No CAPE files.
Sorry! No process dumps.

Processing ( 5.3420000000000005 seconds )

  • 5.211 Suricata
  • 0.11 CAPE
  • 0.016 AnalysisInfo
  • 0.005 Debug

Signatures ( 0.05500000000000001 seconds )

  • 0.011 ransomware_files
  • 0.007 antiav_detectreg
  • 0.006 ransomware_extensions
  • 0.005 antiav_detectfile
  • 0.003 persistence_autorun
  • 0.003 infostealer_bitcoin
  • 0.003 infostealer_ftp
  • 0.002 tinba_behavior
  • 0.002 antianalysis_detectfile
  • 0.002 antivm_vbox_files
  • 0.002 infostealer_im
  • 0.002 masquerade_process_name
  • 0.001 kibex_behavior
  • 0.001 antianalysis_detectreg
  • 0.001 geodo_banking_trojan
  • 0.001 browser_security
  • 0.001 disables_browser_warn
  • 0.001 infostealer_mail
  • 0.001 revil_mutexes

Reporting ( 0.062 seconds )

  • 0.04 JsonDump
  • 0.022 PCAP2CERT