Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-03-2022 04:33
General
-
Target
6701c8d100f4a7944a83c916ca82e46eea47b4d837233c5a7ca3ed52164244bd.exe
-
Size
219KB
-
MD5
8fa871ab53d625c35a79c8cba03d7e33
-
SHA1
55b737ea519880d01ef659c210890e1de283797f
-
SHA256
6701c8d100f4a7944a83c916ca82e46eea47b4d837233c5a7ca3ed52164244bd
-
SHA512
f4da5bb9d302841ebf5eb957ab36326c3c189de1dcb0723a19e8a831d6b1106a9e09312e56c24c7defc3a9e6ac2762b79989a4679e603a346686efe40c0d9439
Malware Config
Extracted
emotet
Epoch2
67.163.161.107:80
107.170.146.252:8080
173.212.214.235:7080
167.114.153.111:8080
185.94.252.104:443
110.142.236.207:80
194.187.133.160:443
218.147.193.146:80
172.104.97.173:8080
216.139.123.119:80
50.91.114.38:80
202.134.4.211:8080
113.61.66.94:80
139.99.158.11:443
62.171.142.179:8080
37.139.21.175:8080
190.108.228.27:443
94.23.237.171:443
154.91.33.137:443
201.241.127.190:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet Payload 3 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6701c8d100f4a7944a83c916ca82e46eea47b4d837233c5a7ca3ed52164244bd.exe"C:\Users\Admin\AppData\Local\Temp\6701c8d100f4a7944a83c916ca82e46eea47b4d837233c5a7ca3ed52164244bd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1636-54-0x00000000002A0000-0x00000000002C0000-memory.dmpFilesize
128KB
-
memory/1636-57-0x00000000003C0000-0x00000000003DE000-memory.dmpFilesize
120KB
-
memory/1636-60-0x0000000000280000-0x000000000029D000-memory.dmpFilesize
116KB
-
memory/1636-61-0x0000000076921000-0x0000000076923000-memory.dmpFilesize
8KB