Analysis
-
max time kernel
131s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
25-02-2022 03:33
General
-
Target
22f8917155f0f87fcf68e94c2256f82c911f34c2d9ab20a73dab87481caee39c.exe
-
Size
731KB
-
MD5
1fc8b9d820a2f60f57737d2fcb56b383
-
SHA1
09f0f6d4e87258e3b7455d1b51ee98d4975d9720
-
SHA256
22f8917155f0f87fcf68e94c2256f82c911f34c2d9ab20a73dab87481caee39c
-
SHA512
3a3c9b9d63f1d939fe2b8da2719f506a56b9d0c06d8b3f0da61519487606c15cd077ee17f3d74ec42903efed50af16ba1ec2740309cc501a7adf73b3538b7e06
Malware Config
Extracted
emotet
Epoch2
184.180.181.202:80
169.50.76.149:8080
162.241.140.129:8080
104.131.123.136:443
194.187.133.160:443
71.15.245.148:8080
37.139.21.175:8080
104.131.11.150:443
118.83.154.64:443
24.137.76.62:80
79.137.83.50:443
69.206.132.149:80
110.142.236.207:80
123.176.25.234:80
120.150.60.189:80
209.54.13.14:80
95.213.236.64:8080
209.141.54.221:8080
96.245.227.43:80
87.106.139.101:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet Payload 3 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\22f8917155f0f87fcf68e94c2256f82c911f34c2d9ab20a73dab87481caee39c.exe"C:\Users\Admin\AppData\Local\Temp\22f8917155f0f87fcf68e94c2256f82c911f34c2d9ab20a73dab87481caee39c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1276-130-0x0000000002320000-0x0000000002338000-memory.dmpFilesize
96KB
-
memory/1276-133-0x0000000002340000-0x0000000002357000-memory.dmpFilesize
92KB
-
memory/1276-135-0x00000000022E0000-0x00000000022F6000-memory.dmpFilesize
88KB