Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
28-02-2021 07:18
General
-
Target
4c49c4fe7ec89abd3982573fae6768c71f9da1d343819dbf11aeec2ccc862010.exe
-
Size
417KB
-
MD5
e06d94ac992fd166a7252ed7e19a9b35
-
SHA1
ce889528ed2e502d0d4be83723dd49c9e8ab3d5a
-
SHA256
4c49c4fe7ec89abd3982573fae6768c71f9da1d343819dbf11aeec2ccc862010
-
SHA512
4e7441edb25ce034adad09661755c580985f79876c6838e2432e368f6bed293193e9f39fa24dfbd91ce0dfc484e0a9d2079b9f35c3130e148d24bfff5e47f426
Malware Config
Extracted
emotet
Epoch1
177.85.167.10:80
186.188.212.201:80
94.23.62.116:8080
98.103.204.12:443
59.148.253.194:8080
216.47.196.104:80
94.176.234.118:443
137.74.106.111:7080
181.61.182.143:80
177.107.79.214:8080
85.214.26.7:8080
51.75.33.127:80
190.190.219.184:80
70.32.84.74:8080
81.214.253.80:443
77.238.212.227:80
78.206.229.130:80
103.236.179.162:80
213.197.182.158:8080
101.187.81.254:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet Payload 3 IoCs
Detects Emotet payload in memory.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c49c4fe7ec89abd3982573fae6768c71f9da1d343819dbf11aeec2ccc862010.exe"C:\Users\Admin\AppData\Local\Temp\4c49c4fe7ec89abd3982573fae6768c71f9da1d343819dbf11aeec2ccc862010.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/532-2-0x0000000075C61000-0x0000000075C63000-memory.dmpFilesize
8KB
-
memory/532-3-0x0000000000260000-0x0000000000272000-memory.dmpFilesize
72KB
-
memory/532-4-0x0000000000280000-0x0000000000290000-memory.dmpFilesize
64KB
-
memory/532-5-0x0000000000250000-0x0000000000260000-memory.dmpFilesize
64KB
-
memory/1428-6-0x000007FEF7040000-0x000007FEF72BA000-memory.dmpFilesize
2.5MB