Analysis
-
max time kernel
144s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 18:26
General
-
Target
9ee86c09d7372bcd9be4ad4cab75d917f7eb0619cc43f916718db1480c594102.exe
-
Size
848KB
-
MD5
8d0dbb0c0aa859b89538c77072cbd548
-
SHA1
18f53915bdbda2cc54bc0921ac8f63b82d433044
-
SHA256
9ee86c09d7372bcd9be4ad4cab75d917f7eb0619cc43f916718db1480c594102
-
SHA512
b306037fa7de14c63d13390d9df6367c70ef23cc966553cb5c34c48da3175c835402c8e68e31135a10f6d99d4c690a2687cb6ed3f6f515d161f3fd6e423622aa
Malware Config
Extracted
emotet
Epoch3
190.136.179.102:80
97.107.135.148:8080
94.102.209.63:7080
162.144.42.60:8080
81.214.253.80:443
87.106.231.60:8080
107.161.30.122:8080
66.61.94.36:80
139.59.12.63:8080
203.153.216.178:7080
178.33.167.120:8080
179.62.238.49:80
50.116.78.109:8080
74.208.173.91:8080
113.161.148.81:80
179.5.118.12:80
202.5.47.71:80
91.83.93.103:443
181.113.229.139:443
41.185.29.128:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M9
suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M9
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ee86c09d7372bcd9be4ad4cab75d917f7eb0619cc43f916718db1480c594102.exe"C:\Users\Admin\AppData\Local\Temp\9ee86c09d7372bcd9be4ad4cab75d917f7eb0619cc43f916718db1480c594102.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2916-130-0x0000000002300000-0x000000000230C000-memory.dmpFilesize
48KB
-
memory/2916-134-0x00000000022F0000-0x00000000022F9000-memory.dmpFilesize
36KB