Analysis
-
max time kernel
292s -
max time network
299s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-06-2022 13:51
General
-
Target
6c2e494f16262d6e4b2eaa552971b562a2bb87ac71a73a8be8638aefb47f1a47.exe
-
Size
244KB
-
MD5
ec6363acaf183e7c3bcdc5b009ac277c
-
SHA1
94bf19b87591a990a40ea61e3235314a02f105e2
-
SHA256
6c2e494f16262d6e4b2eaa552971b562a2bb87ac71a73a8be8638aefb47f1a47
-
SHA512
be05c7ef26a3216cd01cbadb1086962caae4075a0ce322c248c56ad3d97c9cb85d19173e52db754152eac8678317ea637fe18d10cc89133f7eadc885fb92d402
Malware Config
Extracted
emotet
Epoch2
174.118.202.24:443
161.0.153.60:80
64.207.182.168:8080
51.89.36.180:443
51.89.199.141:8080
109.116.245.80:80
50.91.114.38:80
188.219.31.12:80
109.74.5.95:8080
201.171.244.130:80
190.162.215.233:80
74.40.205.197:443
118.83.154.64:443
134.209.144.106:443
104.131.11.150:443
200.116.145.225:443
96.245.227.43:80
24.137.76.62:80
172.86.188.251:8080
139.59.60.244:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet Payload 5 IoCs
Detects Emotet payload in memory.
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c2e494f16262d6e4b2eaa552971b562a2bb87ac71a73a8be8638aefb47f1a47.exe"C:\Users\Admin\AppData\Local\Temp\6c2e494f16262d6e4b2eaa552971b562a2bb87ac71a73a8be8638aefb47f1a47.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rasman\mfasfsrcsnk.exe"C:\Windows\SysWOW64\rasman\mfasfsrcsnk.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
244KB
MD5ec6363acaf183e7c3bcdc5b009ac277c
SHA194bf19b87591a990a40ea61e3235314a02f105e2
SHA2566c2e494f16262d6e4b2eaa552971b562a2bb87ac71a73a8be8638aefb47f1a47
SHA512be05c7ef26a3216cd01cbadb1086962caae4075a0ce322c248c56ad3d97c9cb85d19173e52db754152eac8678317ea637fe18d10cc89133f7eadc885fb92d402
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
60KB
-
Filesize
72KB
-
Filesize
64KB