Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 18:28
General
-
Target
720fab22a69d932ac57400e4ceb5b2a14371c325d545ddd35449bc1ef7c52953.exe
-
Size
496KB
-
MD5
892b13159a4f1e6ffa20e01a7c591ec4
-
SHA1
25ea02508aaacdd4346b9857929d993efa2fc32a
-
SHA256
720fab22a69d932ac57400e4ceb5b2a14371c325d545ddd35449bc1ef7c52953
-
SHA512
eeafdffb3a407d17afeb6de35257f950b58d5d061c5e7e1280b4ed679dc6bb593459afef0efe3df1251d1c29f380014de16f31300179d78ff5d422d2e8eb149f
Malware Config
Extracted
emotet
Epoch3
210.1.219.238:80
162.144.42.60:8080
134.209.193.138:443
68.183.233.80:8080
172.105.78.244:8080
181.113.229.139:443
139.59.12.63:8080
185.142.236.163:443
113.203.250.121:443
74.208.173.91:8080
173.94.215.84:80
31.146.61.34:80
115.78.11.155:80
95.216.205.155:8080
82.239.200.118:80
81.17.93.134:80
179.5.118.12:80
162.249.220.190:80
77.74.78.80:443
24.26.151.3:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M9
suricata: ET MALWARE Win32/Emotet CnC Activity (POST) M9
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\720fab22a69d932ac57400e4ceb5b2a14371c325d545ddd35449bc1ef7c52953.exe"C:\Users\Admin\AppData\Local\Temp\720fab22a69d932ac57400e4ceb5b2a14371c325d545ddd35449bc1ef7c52953.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/948-54-0x0000000074F21000-0x0000000074F23000-memory.dmpFilesize
8KB
-
memory/948-55-0x0000000000240000-0x000000000024C000-memory.dmpFilesize
48KB
-
memory/948-59-0x0000000000230000-0x0000000000239000-memory.dmpFilesize
36KB