Analysis
-
max time kernel
131s -
max time network
143s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-03-2022 04:26
General
-
Target
686c776ed1ec72ef93d2cd9dddec4a0775e257de2731170dddca1b125d5fab14.exe
-
Size
356KB
-
MD5
32071960898d621df70a80de7f982dbd
-
SHA1
2e52e4baeffe6c691624003819c57288df77b71e
-
SHA256
686c776ed1ec72ef93d2cd9dddec4a0775e257de2731170dddca1b125d5fab14
-
SHA512
cc2aa6bd5c4ce02c57c88f015c33353e9ed9d0bd5962ee3dd6df870a56685722c1a32f22974eb9c4faf2c727d5e45a242d6acbdb251cc068ca262875613ee0b7
Malware Config
Extracted
emotet
Epoch2
102.182.145.130:80
173.173.254.105:80
64.207.182.168:8080
51.89.199.141:8080
167.114.153.111:8080
173.63.222.65:80
218.147.193.146:80
59.125.219.109:443
172.104.97.173:8080
190.162.215.233:80
68.115.186.26:80
78.188.106.53:443
190.240.194.77:443
24.133.106.23:80
80.227.52.78:80
79.137.83.50:443
120.150.218.241:443
62.171.142.179:8080
194.4.58.192:7080
62.30.7.67:443
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet Payload 3 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\686c776ed1ec72ef93d2cd9dddec4a0775e257de2731170dddca1b125d5fab14.exe"C:\Users\Admin\AppData\Local\Temp\686c776ed1ec72ef93d2cd9dddec4a0775e257de2731170dddca1b125d5fab14.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1932-55-0x0000000076511000-0x0000000076513000-memory.dmpFilesize
8KB
-
memory/1932-56-0x00000000025E0000-0x0000000002614000-memory.dmpFilesize
208KB
-
memory/1932-59-0x0000000002B20000-0x0000000002B53000-memory.dmpFilesize
204KB
-
memory/1932-62-0x00000000025A0000-0x00000000025D1000-memory.dmpFilesize
196KB