Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
01-03-2022 04:33
General
-
Target
6701c8d100f4a7944a83c916ca82e46eea47b4d837233c5a7ca3ed52164244bd.exe
-
Size
219KB
-
MD5
8fa871ab53d625c35a79c8cba03d7e33
-
SHA1
55b737ea519880d01ef659c210890e1de283797f
-
SHA256
6701c8d100f4a7944a83c916ca82e46eea47b4d837233c5a7ca3ed52164244bd
-
SHA512
f4da5bb9d302841ebf5eb957ab36326c3c189de1dcb0723a19e8a831d6b1106a9e09312e56c24c7defc3a9e6ac2762b79989a4679e603a346686efe40c0d9439
Malware Config
Extracted
emotet
Epoch2
67.163.161.107:80
107.170.146.252:8080
173.212.214.235:7080
167.114.153.111:8080
185.94.252.104:443
110.142.236.207:80
194.187.133.160:443
218.147.193.146:80
172.104.97.173:8080
216.139.123.119:80
50.91.114.38:80
202.134.4.211:8080
113.61.66.94:80
139.99.158.11:443
62.171.142.179:8080
37.139.21.175:8080
190.108.228.27:443
94.23.237.171:443
154.91.33.137:443
201.241.127.190:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M11
suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M11
-
Emotet Payload 3 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6701c8d100f4a7944a83c916ca82e46eea47b4d837233c5a7ca3ed52164244bd.exe"C:\Users\Admin\AppData\Local\Temp\6701c8d100f4a7944a83c916ca82e46eea47b4d837233c5a7ca3ed52164244bd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1488-130-0x0000000000720000-0x0000000000740000-memory.dmpFilesize
128KB
-
memory/1488-133-0x0000000000A50000-0x0000000000A6E000-memory.dmpFilesize
120KB
-
memory/1488-136-0x0000000000700000-0x000000000071D000-memory.dmpFilesize
116KB