Analysis
-
max time kernel
146s -
max time network
155s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
09-09-2021 07:49
General
-
Target
2cb7516c937ad8b9467ca417530651e34340d231c3696149c7d7b22e24ffaf9b.exe
-
Size
356KB
-
MD5
3639d17c4944743ac5c70c4e1bd30178
-
SHA1
0047a882cf542b94754496c8cb985ab64561f72c
-
SHA256
2cb7516c937ad8b9467ca417530651e34340d231c3696149c7d7b22e24ffaf9b
-
SHA512
efbc3c75d893baa3e5fc5329ef7bc3163e686850f9196e2ba758b486b18743fd2487476976d6c55b826da2ab1a017ae854af0c53d4b95865a5221a387ba9ad11
Malware Config
Extracted
emotet
Epoch2
102.182.145.130:80
173.173.254.105:80
64.207.182.168:8080
51.89.199.141:8080
167.114.153.111:8080
173.63.222.65:80
218.147.193.146:80
59.125.219.109:443
172.104.97.173:8080
190.162.215.233:80
68.115.186.26:80
78.188.106.53:443
190.240.194.77:443
24.133.106.23:80
80.227.52.78:80
79.137.83.50:443
120.150.218.241:443
62.171.142.179:8080
194.4.58.192:7080
62.30.7.67:443
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet Payload 3 IoCs
Detects Emotet payload in memory.
-
Modifies data under HKEY_USERS 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cb7516c937ad8b9467ca417530651e34340d231c3696149c7d7b22e24ffaf9b.exe"C:\Users\Admin\AppData\Local\Temp\2cb7516c937ad8b9467ca417530651e34340d231c3696149c7d7b22e24ffaf9b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NgcSvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208KB
-
Filesize
204KB
-
Filesize
140KB
-
Filesize
196KB