Analysis
-
max time kernel
153s -
max time network
169s -
platform
windows10_x64 -
resource
win10-en -
submitted
14-09-2021 06:37
General
-
Target
d3ead488ec0b44a97df99a563ee547a7ea505b2c26ccd03474a8d8493c359b84.exe
-
Size
424KB
-
MD5
8760dfe88feb489630acdaa5d09d4421
-
SHA1
70053a3e446447622bd709b0562811955ab72817
-
SHA256
d3ead488ec0b44a97df99a563ee547a7ea505b2c26ccd03474a8d8493c359b84
-
SHA512
0ec9e16eb0900884f2e6a8722877fb9cd0a40757bb97ad4f55a4717ba01a4f17d60a1a652cd8f63f6f761583fef2aa79d8c9552210c4a2c728ce6fdfc21dc25d
Malware Config
Extracted
emotet
Epoch3
201.212.78.182:80
74.207.230.187:8080
81.214.253.80:443
181.167.35.84:80
195.201.56.70:8080
37.46.129.215:8080
190.251.235.239:80
192.163.221.191:8080
177.0.241.28:80
41.185.29.128:8080
46.105.131.68:8080
78.188.170.128:80
45.118.136.92:8080
163.172.107.70:8080
37.70.131.107:80
177.144.130.105:443
181.230.65.232:80
192.210.217.94:8080
181.164.110.7:80
50.116.78.109:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet Payload 1 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3ead488ec0b44a97df99a563ee547a7ea505b2c26ccd03474a8d8493c359b84.exe"C:\Users\Admin\AppData\Local\Temp\d3ead488ec0b44a97df99a563ee547a7ea505b2c26ccd03474a8d8493c359b84.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3632-117-0x00000000005A0000-0x00000000005AC000-memory.dmpFilesize
48KB
-
memory/3632-119-0x0000000000470000-0x000000000051E000-memory.dmpFilesize
696KB