Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
09-03-2022 15:44
General
-
Target
47ec7bd720b76817e300f76d3f938b76576fd93135cdf1a8e249ce784cafc9ff.exe
-
Size
261KB
-
MD5
d959c2021dfa3e85617b1f47a9f68293
-
SHA1
076ee22ea713706b6780af801bc48e3d6e9ec96c
-
SHA256
47ec7bd720b76817e300f76d3f938b76576fd93135cdf1a8e249ce784cafc9ff
-
SHA512
a036316027dabcf8957ace86425a7ef9793f0a644a7ced3b2a19957934716e39a9d07c9c34a43644897861355d979497737e419129f098042645ba77ce3a5a40
Malware Config
Extracted
emotet
Epoch2
96.252.116.33:80
110.145.11.73:80
185.201.9.197:8080
64.207.182.168:8080
51.89.36.180:443
208.74.26.234:80
89.216.122.92:80
190.164.104.62:80
62.75.141.82:80
94.230.70.6:80
37.187.72.193:8080
72.186.136.247:443
138.68.87.218:443
120.150.60.189:80
24.69.65.8:8080
110.142.236.207:80
74.208.45.104:8080
113.61.66.94:80
74.128.121.17:80
110.145.101.66:443
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet Payload 3 IoCs
Detects Emotet payload in memory.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\47ec7bd720b76817e300f76d3f938b76576fd93135cdf1a8e249ce784cafc9ff.exe"C:\Users\Admin\AppData\Local\Temp\47ec7bd720b76817e300f76d3f938b76576fd93135cdf1a8e249ce784cafc9ff.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
60KB