Analysis
-
max time kernel
149s -
max time network
161s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 18:33
General
-
Target
239a2befddbf127e82d76d8879f0e5f51bd79258efc32cee9dd39a593bdf6a7f.exe
-
Size
100KB
-
MD5
18e192a4c988800ba61fdf11e5eb5496
-
SHA1
f3ccb689fb8d48723638dd9235683fe1f016b161
-
SHA256
239a2befddbf127e82d76d8879f0e5f51bd79258efc32cee9dd39a593bdf6a7f
-
SHA512
dea2a57b40ad81342999f1f1d7ae8c5e309ff9ef594bb55e516ac789ec2900bf13f6dcb51927f7d69c2cb3fe75da9b1ff4b71dc990147e6749f8e9268906a02e
Malware Config
Extracted
emotet
Epoch3
118.110.236.121:8080
149.202.5.139:443
153.92.4.96:8080
51.75.163.68:7080
46.32.229.152:8080
192.241.220.183:8080
173.94.215.84:80
188.0.135.237:80
45.182.161.17:80
74.208.173.91:8080
81.214.253.80:443
157.7.164.178:8081
162.249.220.190:80
192.163.221.191:8080
77.74.78.80:443
175.29.183.2:80
190.190.15.20:80
188.251.213.180:443
222.159.240.58:80
175.139.144.229:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\239a2befddbf127e82d76d8879f0e5f51bd79258efc32cee9dd39a593bdf6a7f.exe"C:\Users\Admin\AppData\Local\Temp\239a2befddbf127e82d76d8879f0e5f51bd79258efc32cee9dd39a593bdf6a7f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/336-54-0x00000000752A1000-0x00000000752A3000-memory.dmpFilesize
8KB
-
memory/336-55-0x00000000002A0000-0x00000000002AC000-memory.dmpFilesize
48KB
-
memory/336-59-0x0000000000290000-0x0000000000299000-memory.dmpFilesize
36KB