Analysis
-
max time kernel
143s -
max time network
145s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-11-2020 14:48
Static task
static1
Behavioral task
behavioral1
Sample
d1b8a02c16ffa7c6a445d56c20358114.exe
Resource
win7v20201028
General
-
Target
d1b8a02c16ffa7c6a445d56c20358114.exe
-
Size
816KB
-
MD5
55328103bca0438596479026d4e72326
-
SHA1
7e6452780a4e16c23a2f2747ec642aa7bd3fce60
-
SHA256
8fc9f9295b77940826a359976248b588074ce3fda76d38fe67370bde2422a6c1
-
SHA512
efcb80c640b0458d9166c29ed91e5d1a9593b9e7ad2b08470a3439c9794a533353cc4d44e29df9c5e279318306283c1e563b0dcab612b908f023c8272c8504cc
Malware Config
Extracted
emotet
Epoch2
79.7.158.208:80
46.105.131.87:80
209.141.54.221:8080
78.189.165.52:8080
37.139.21.175:8080
98.15.140.226:80
103.86.49.11:8080
41.60.200.34:80
190.55.181.54:443
120.151.135.224:80
162.154.38.103:80
60.130.173.117:80
5.196.74.210:8080
46.105.131.79:8080
168.235.67.138:7080
24.1.189.87:8080
95.213.236.64:8080
74.208.45.104:8080
41.215.92.157:80
87.106.139.101:8080
73.11.153.178:8080
104.131.44.150:8080
153.126.210.205:7080
211.63.71.72:8080
173.91.22.41:80
101.187.97.173:80
121.124.124.40:7080
190.144.18.198:80
62.138.26.28:8080
169.239.182.217:8080
190.160.53.126:80
5.39.91.110:7080
95.128.43.213:8080
104.236.246.93:8080
201.173.217.124:443
176.111.60.55:8080
110.145.77.103:80
114.145.241.208:80
153.133.224.78:80
139.130.242.43:80
185.94.252.104:443
104.131.11.150:443
87.106.136.232:8080
31.31.77.83:443
91.205.215.66:443
178.20.74.212:80
75.139.38.211:80
50.116.86.205:8080
93.51.50.171:8080
162.241.92.219:8080
62.75.141.82:80
113.160.130.116:8443
78.24.219.147:8080
37.187.72.193:8080
62.75.187.192:8080
79.45.112.220:80
186.208.123.210:443
58.171.38.26:80
200.41.121.90:80
41.203.62.170:80
Signatures
-
Suspicious behavior: EmotetMutantsSpam 1 IoCs
Processes:
d1b8a02c16ffa7c6a445d56c20358114.exepid process 292 d1b8a02c16ffa7c6a445d56c20358114.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
d1b8a02c16ffa7c6a445d56c20358114.exepid process 292 d1b8a02c16ffa7c6a445d56c20358114.exe 292 d1b8a02c16ffa7c6a445d56c20358114.exe 292 d1b8a02c16ffa7c6a445d56c20358114.exe 292 d1b8a02c16ffa7c6a445d56c20358114.exe 292 d1b8a02c16ffa7c6a445d56c20358114.exe 292 d1b8a02c16ffa7c6a445d56c20358114.exe 292 d1b8a02c16ffa7c6a445d56c20358114.exe 292 d1b8a02c16ffa7c6a445d56c20358114.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
d1b8a02c16ffa7c6a445d56c20358114.exepid process 292 d1b8a02c16ffa7c6a445d56c20358114.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/292-0-0x0000000000200000-0x000000000020E000-memory.dmpFilesize
56KB
-
memory/292-1-0x0000000000290000-0x000000000029C000-memory.dmpFilesize
48KB
-
memory/292-3-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1184-2-0x000007FEF6460000-0x000007FEF66DA000-memory.dmpFilesize
2.5MB