Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
07-03-2022 12:21
General
-
Target
edabc9bb5d416ebc29a734360dd7f5946b599f845b2e00ef3b4e245711ba2baf.exe
-
Size
372KB
-
MD5
7a123663b3352fc8afcfcefb397c4023
-
SHA1
7554ce3190128cf6a90623c0dda2b543a0d5f29d
-
SHA256
edabc9bb5d416ebc29a734360dd7f5946b599f845b2e00ef3b4e245711ba2baf
-
SHA512
a43dc9113584800cd9fde85c213625d7b0463cb0ea63abae149561edc37b5cbfc740a59a3dfb50a602d90e9ca46275e2edd557205a53b0ab1eb4b32940453dda
Malware Config
Extracted
emotet
Epoch2
96.252.116.33:80
110.145.11.73:80
185.201.9.197:8080
64.207.182.168:8080
51.89.36.180:443
208.74.26.234:80
89.216.122.92:80
190.164.104.62:80
62.75.141.82:80
94.230.70.6:80
37.187.72.193:8080
72.186.136.247:443
138.68.87.218:443
120.150.60.189:80
24.69.65.8:8080
110.142.236.207:80
74.208.45.104:8080
113.61.66.94:80
74.128.121.17:80
110.145.101.66:443
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet Payload 3 IoCs
Detects Emotet payload in memory.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\edabc9bb5d416ebc29a734360dd7f5946b599f845b2e00ef3b4e245711ba2baf.exe"C:\Users\Admin\AppData\Local\Temp\edabc9bb5d416ebc29a734360dd7f5946b599f845b2e00ef3b4e245711ba2baf.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1872-130-0x0000000000570000-0x0000000000582000-memory.dmpFilesize
72KB
-
memory/1872-134-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/1872-137-0x0000000000510000-0x000000000051F000-memory.dmpFilesize
60KB