Analysis
-
max time kernel
144s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
02-03-2022 07:32
General
-
Target
783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340.exe
-
Size
568KB
-
MD5
9f471252b0669d62887c52f8feaf0b55
-
SHA1
0f1120faaf00317226c9cc739c0314045c540e0f
-
SHA256
783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340
-
SHA512
0ed77d4fa5c937a0ee382527de0dc4d8ccaea733cd0b70ed75cd4417dab99b8348fe9d56dde7a9c1bdb06b5d829b061dc4b00a0e58cd038b7a9ef49451a67d28
Malware Config
Extracted
emotet
Epoch2
88.153.35.32:80
107.170.146.252:8080
173.212.214.235:7080
167.114.153.111:8080
202.141.243.254:443
75.143.247.51:80
85.105.111.166:80
216.139.123.119:80
113.61.66.94:80
162.241.140.129:8080
190.12.119.180:443
2.58.16.89:8080
91.211.88.52:7080
93.147.212.206:80
71.15.245.148:8080
157.245.99.39:8080
27.114.9.93:80
50.91.114.38:80
174.106.122.139:80
47.36.140.164:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet Payload 1 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340.exe"C:\Users\Admin\AppData\Local\Temp\783fc771ce2a9a19c446b6d9d9ac512a0f2992729f420d60e1b8e6781ca58340.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB