Analysis
-
max time kernel
119s -
max time network
163s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
16-06-2021 08:28
General
-
Target
045ef86160e0a77a2a6d766cacbca7801b9e861d75644cdd71795f09282af4fd.bin.exe
-
Size
304KB
-
MD5
eb3a252bb685113cc92b291b81987fd4
-
SHA1
da3dff5adcd74128eff18b973037534d93ded659
-
SHA256
045ef86160e0a77a2a6d766cacbca7801b9e861d75644cdd71795f09282af4fd
-
SHA512
e455a1a6109b9cc8a6913ed73e5e4cedb546dbb44e3e42b27cc43369e17c22513e819919f6ab1db06da9f1b8aa5079e0e14305657437c4674780e5bd86905b5c
Malware Config
Extracted
emotet
Epoch1
181.30.69.50:80
157.7.199.53:8080
190.163.1.31:8080
68.183.170.114:8080
192.241.143.52:8080
192.241.146.84:8080
46.214.11.172:80
61.92.159.208:8080
104.131.41.185:8080
137.74.106.111:7080
5.196.35.138:7080
89.32.150.160:8080
177.144.135.2:80
190.194.242.254:443
217.199.160.224:7080
83.169.21.32:7080
190.17.195.202:80
111.67.12.221:8080
177.66.190.130:80
186.70.127.199:8090
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet Payload 2 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\045ef86160e0a77a2a6d766cacbca7801b9e861d75644cdd71795f09282af4fd.bin.exe"C:\Users\Admin\AppData\Local\Temp\045ef86160e0a77a2a6d766cacbca7801b9e861d75644cdd71795f09282af4fd.bin.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x48c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
48KB
-
Filesize
36KB