Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 18:32
General
-
Target
326241bd68701cf431e393e64bdcae05dd1240167f88354f23fcdf404c211674.exe
-
Size
100KB
-
MD5
3e89dd67bac871f295d730f34b904aa4
-
SHA1
0fb6a0de606db850cc322f4a5e8416f6ebb54fcd
-
SHA256
326241bd68701cf431e393e64bdcae05dd1240167f88354f23fcdf404c211674
-
SHA512
b1d0c7dcbdbe5c38acec3ddd9429b3d208d96c05e98ce7f4028f6d7b23f5dcc03aa75c31a5e18b73c5cb3e779b5ee9d53c655607dcaa9fb3ff39d7dc03bdc3ba
Malware Config
Extracted
emotet
Epoch3
118.110.236.121:8080
149.202.5.139:443
153.92.4.96:8080
51.75.163.68:7080
46.32.229.152:8080
192.241.220.183:8080
173.94.215.84:80
188.0.135.237:80
45.182.161.17:80
74.208.173.91:8080
81.214.253.80:443
157.7.164.178:8081
162.249.220.190:80
192.163.221.191:8080
77.74.78.80:443
175.29.183.2:80
190.190.15.20:80
188.251.213.180:443
222.159.240.58:80
175.139.144.229:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\326241bd68701cf431e393e64bdcae05dd1240167f88354f23fcdf404c211674.exe"C:\Users\Admin\AppData\Local\Temp\326241bd68701cf431e393e64bdcae05dd1240167f88354f23fcdf404c211674.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1092-54-0x0000000075F61000-0x0000000075F63000-memory.dmpFilesize
8KB
-
memory/1092-55-0x00000000002E0000-0x00000000002EC000-memory.dmpFilesize
48KB
-
memory/1092-59-0x00000000002D0000-0x00000000002D9000-memory.dmpFilesize
36KB