Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
30-09-2021 09:19
General
-
Target
e00b5bb36ae9fc1b14d24a3d24ac3ecad7856dc775e7c0fe37fd34ac6345a635.exe
-
Size
1.1MB
-
MD5
54b9c5c7b95530a4215b3c611de01bbe
-
SHA1
d434302ee94d27a6066df46f4222f7501c8520d5
-
SHA256
e00b5bb36ae9fc1b14d24a3d24ac3ecad7856dc775e7c0fe37fd34ac6345a635
-
SHA512
292308b21dc9a110444b2b407d41078af4b64ed0460f2a64d1ae2a5392acf4331f59cd8b0639ef659cb1d88502016cc5cfc307f21275b6e2136ff8604abfd82c
Malware Config
Extracted
emotet
Epoch1
50.121.220.50:80
51.75.33.122:80
54.37.42.48:8080
91.121.54.71:8080
45.16.226.117:443
68.69.155.181:80
213.60.96.117:80
77.55.211.77:8080
152.169.22.67:80
110.142.219.51:80
2.47.112.152:80
206.15.68.237:443
217.13.106.14:8080
191.99.160.58:80
189.131.57.131:80
213.197.182.158:8080
94.176.234.118:443
61.92.159.208:8080
190.128.173.10:80
219.92.8.17:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e00b5bb36ae9fc1b14d24a3d24ac3ecad7856dc775e7c0fe37fd34ac6345a635.exe"C:\Users\Admin\AppData\Local\Temp\e00b5bb36ae9fc1b14d24a3d24ac3ecad7856dc775e7c0fe37fd34ac6345a635.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1776-53-0x0000000076851000-0x0000000076853000-memory.dmpFilesize
8KB
-
memory/1776-54-0x0000000000330000-0x000000000033C000-memory.dmpFilesize
48KB
-
memory/1776-57-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB