Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 18:28
General
-
Target
6850f1255d3a749d3125315f88e034576422fe6a75e55ebb1f7ba2249e9af613.exe
-
Size
100KB
-
MD5
52a793166aef15f64bef16e4fe3e76ce
-
SHA1
0dae1a7ff59a2ecbca3e34607a2f56a05f56acd2
-
SHA256
6850f1255d3a749d3125315f88e034576422fe6a75e55ebb1f7ba2249e9af613
-
SHA512
088cfec61db1c67d3dbf71367d7fa15d803d2fdc3a6467a47efebf2e26de77daa85b357090ce6f73f674542a2da73fc86335cb23f73923e4ed6090733edf84ac
Malware Config
Extracted
emotet
Epoch3
118.110.236.121:8080
149.202.5.139:443
153.92.4.96:8080
51.75.163.68:7080
46.32.229.152:8080
192.241.220.183:8080
173.94.215.84:80
188.0.135.237:80
45.182.161.17:80
74.208.173.91:8080
81.214.253.80:443
157.7.164.178:8081
162.249.220.190:80
192.163.221.191:8080
77.74.78.80:443
175.29.183.2:80
190.190.15.20:80
188.251.213.180:443
222.159.240.58:80
175.139.144.229:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6850f1255d3a749d3125315f88e034576422fe6a75e55ebb1f7ba2249e9af613.exe"C:\Users\Admin\AppData\Local\Temp\6850f1255d3a749d3125315f88e034576422fe6a75e55ebb1f7ba2249e9af613.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/884-54-0x00000000763B1000-0x00000000763B3000-memory.dmpFilesize
8KB
-
memory/884-55-0x00000000003B0000-0x00000000003BC000-memory.dmpFilesize
48KB
-
memory/884-59-0x00000000003A0000-0x00000000003A9000-memory.dmpFilesize
36KB