Analysis
-
max time kernel
144s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
02-03-2022 11:14
General
-
Target
6f3beab7e1972c129b10fab82cf5e954d3373f47416c571752ef8ac893599052.exe
-
Size
168KB
-
MD5
e88ea4120a6a34a72bf2d556b5219e5f
-
SHA1
bb2ebea07355e3dc1960d2b954e6b2874b0ea2dc
-
SHA256
6f3beab7e1972c129b10fab82cf5e954d3373f47416c571752ef8ac893599052
-
SHA512
35d6fefd405504c50520bfde9ee3df24c64d673586a872900e799c1634cfdc6f66c678bbc925563814deccd313760709ec4ae16ab01179b2ddfa118c1fadf188
Malware Config
Extracted
emotet
Epoch2
67.10.155.92:80
38.111.46.46:8080
134.209.36.254:8080
162.241.242.173:8080
2.84.135.163:80
94.1.108.190:443
140.186.212.146:80
95.179.229.244:8080
200.114.213.233:8080
113.61.66.94:80
190.240.194.77:443
61.19.246.238:443
110.5.16.198:80
83.169.36.251:8080
37.187.72.193:8080
176.111.60.55:8080
85.105.205.77:8080
168.235.67.138:7080
200.123.150.89:443
87.106.139.101:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet Payload 3 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f3beab7e1972c129b10fab82cf5e954d3373f47416c571752ef8ac893599052.exe"C:\Users\Admin\AppData\Local\Temp\6f3beab7e1972c129b10fab82cf5e954d3373f47416c571752ef8ac893599052.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3016-130-0x0000000002190000-0x00000000021A2000-memory.dmpFilesize
72KB
-
memory/3016-133-0x00000000021B0000-0x00000000021C0000-memory.dmpFilesize
64KB
-
memory/3016-135-0x0000000002180000-0x000000000218F000-memory.dmpFilesize
60KB