Analysis
-
max time kernel
137s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
29-08-2021 16:43
General
-
Target
aacc.exe
-
Size
349KB
-
MD5
f2f08b57e8914390f972abeeb1386ac5
-
SHA1
655a1a166fb756683d8b48068a1e2e002c64442d
-
SHA256
3838e56e07f1e8979726ed6b4039e4bddb7b90a3d9c41a229d03024921b8aa7f
-
SHA512
7dfe1fb09fa26d8042c6c8c530bc9da7fc031b5543a2a5069a6f607042b192911f5bc9fab95a34b4ab72a501f552ff5fd20742c2cfeea6594c8a4036573c9355
Malware Config
Extracted
emotet
Epoch2
115.94.207.99:443
5.196.108.185:8080
167.114.153.111:8080
87.106.136.232:8080
62.30.7.67:443
108.46.29.236:80
24.179.13.119:80
89.121.205.18:80
46.105.131.79:8080
173.63.222.65:80
174.45.13.118:80
216.139.123.119:80
172.91.208.86:80
155.186.9.160:80
96.245.227.43:80
102.182.93.220:80
24.230.141.169:80
104.131.123.136:443
104.131.11.150:443
203.153.216.189:7080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet Payload 1 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aacc.exe"C:\Users\Admin\AppData\Local\Temp\aacc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
356KB
-
Filesize
292KB