Analysis
-
max time kernel
311s -
max time network
317s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-06-2022 13:51
General
-
Target
455d08a5e2a10427eb1aec8f9ee931a5ae10b41acb9cf0e9090f87722a96b9ce.exe
-
Size
296KB
-
MD5
ac35802d7f24f8c48231c4ad3dba6ca8
-
SHA1
d4e091c21fbd85e1b3ab5ff2f03eb89df2ffb9bd
-
SHA256
455d08a5e2a10427eb1aec8f9ee931a5ae10b41acb9cf0e9090f87722a96b9ce
-
SHA512
f980d12472e06782a1e05a0c9c22e60a54841d63b611b3ecc71fb8475305fc00d01fc266ec21899d0e0dede7ed850f9930ede17d01b874385415450ca952020a
Malware Config
Extracted
emotet
Epoch2
47.146.39.147:80
152.170.205.73:80
185.201.9.197:8080
64.207.182.168:8080
51.89.36.180:443
85.105.111.166:80
139.59.60.244:8080
187.161.206.24:80
98.150.169.135:80
123.176.25.234:80
74.40.205.197:443
24.179.13.119:80
188.219.31.12:80
172.86.188.251:8080
76.175.162.101:80
72.27.212.209:8080
173.173.254.105:80
120.150.60.189:80
139.99.158.11:443
155.186.9.160:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet Payload 5 IoCs
Detects Emotet payload in memory.
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\455d08a5e2a10427eb1aec8f9ee931a5ae10b41acb9cf0e9090f87722a96b9ce.exe"C:\Users\Admin\AppData\Local\Temp\455d08a5e2a10427eb1aec8f9ee931a5ae10b41acb9cf0e9090f87722a96b9ce.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Windows.AccountsControl\expsrv.exe"C:\Windows\SysWOW64\Windows.AccountsControl\expsrv.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
296KB
MD5ac35802d7f24f8c48231c4ad3dba6ca8
SHA1d4e091c21fbd85e1b3ab5ff2f03eb89df2ffb9bd
SHA256455d08a5e2a10427eb1aec8f9ee931a5ae10b41acb9cf0e9090f87722a96b9ce
SHA512f980d12472e06782a1e05a0c9c22e60a54841d63b611b3ecc71fb8475305fc00d01fc266ec21899d0e0dede7ed850f9930ede17d01b874385415450ca952020a
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
60KB