Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
11-07-2022 08:13
Static task
static1
Behavioral task
behavioral1
Sample
1b4f98529066175c4276a6742310fd53bb6b87e8.exe
Resource
win7-20220414-en
General
-
Target
1b4f98529066175c4276a6742310fd53bb6b87e8.exe
-
Size
848KB
-
MD5
4443a18bffc3e43b07946b4d46c430e0
-
SHA1
1b4f98529066175c4276a6742310fd53bb6b87e8
-
SHA256
a64b8a1209a229c458dd3689aa96c142076318690996835afa68425cd809cfc8
-
SHA512
855ac37d1bc5b0b8c66968647e8f220501e38174ad484b07b3942da4f9c1ee1c07060136aa40ed0b9210d931dee595830bacb5375c421ff1a69d7e21c6eaf73c
Malware Config
Extracted
emotet
Epoch1
45.16.226.117:443
91.121.54.71:8080
209.236.123.42:8080
89.32.150.160:8080
45.161.242.102:80
37.52.87.0:80
137.74.106.111:7080
71.197.211.156:80
217.199.160.224:7080
186.70.127.199:8090
50.28.51.143:8080
190.115.18.139:8080
85.105.140.135:443
24.148.98.177:80
181.30.61.163:443
192.241.146.84:8080
185.94.252.27:443
77.238.212.227:80
185.94.252.12:80
190.147.137.153:443
45.33.77.42:8080
187.162.248.237:80
65.36.62.20:80
81.129.198.57:80
46.28.111.142:7080
192.241.143.52:8080
5.196.35.138:7080
73.213.208.163:80
24.135.1.177:80
190.6.193.152:8080
61.92.159.208:8080
212.174.55.22:443
217.13.106.14:8080
24.135.198.218:80
177.72.13.80:80
219.92.13.25:80
219.92.8.17:8080
70.32.84.74:8080
191.182.6.118:80
83.169.21.32:7080
152.169.22.67:80
45.173.88.33:80
67.247.242.247:80
177.73.0.98:443
82.76.111.249:443
72.135.200.124:80
110.142.219.51:80
178.79.163.131:8080
178.250.54.208:8080
199.203.62.165:80
149.62.173.247:8080
82.196.15.205:8080
138.97.60.141:7080
190.190.148.27:8080
190.128.173.10:80
191.99.160.58:80
72.167.223.217:8080
68.183.170.114:8080
206.15.68.237:443
189.2.177.210:443
70.32.115.157:8080
190.24.243.186:80
98.13.75.196:80
104.131.103.37:8080
2.47.112.152:80
111.67.12.221:8080
213.197.182.158:8080
114.109.179.60:80
77.90.136.129:8080
58.171.153.81:80
190.2.31.172:80
212.71.237.140:8080
181.129.96.162:8080
213.60.96.117:80
184.66.18.83:80
178.148.55.236:8080
186.103.141.250:443
12.162.84.2:8080
103.106.236.83:8080
188.2.217.94:80
172.104.169.32:8080
188.135.15.49:80
51.159.23.217:443
177.74.228.34:80
190.163.31.26:80
91.219.169.180:80
174.100.27.229:80
190.195.129.227:8090
189.131.57.131:80
68.183.190.199:8080
77.55.211.77:8080
95.9.180.128:80
87.106.46.107:8080
94.176.234.118:443
85.109.159.61:443
204.225.249.100:7080
51.255.165.160:8080
72.47.248.48:7080
170.81.48.2:80
104.131.41.185:8080
Signatures
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
1b4f98529066175c4276a6742310fd53bb6b87e8.exepid process 3420 1b4f98529066175c4276a6742310fd53bb6b87e8.exe 3420 1b4f98529066175c4276a6742310fd53bb6b87e8.exe 3420 1b4f98529066175c4276a6742310fd53bb6b87e8.exe 3420 1b4f98529066175c4276a6742310fd53bb6b87e8.exe 3420 1b4f98529066175c4276a6742310fd53bb6b87e8.exe 3420 1b4f98529066175c4276a6742310fd53bb6b87e8.exe 3420 1b4f98529066175c4276a6742310fd53bb6b87e8.exe 3420 1b4f98529066175c4276a6742310fd53bb6b87e8.exe 3420 1b4f98529066175c4276a6742310fd53bb6b87e8.exe 3420 1b4f98529066175c4276a6742310fd53bb6b87e8.exe 3420 1b4f98529066175c4276a6742310fd53bb6b87e8.exe 3420 1b4f98529066175c4276a6742310fd53bb6b87e8.exe 3420 1b4f98529066175c4276a6742310fd53bb6b87e8.exe 3420 1b4f98529066175c4276a6742310fd53bb6b87e8.exe 3420 1b4f98529066175c4276a6742310fd53bb6b87e8.exe 3420 1b4f98529066175c4276a6742310fd53bb6b87e8.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
1b4f98529066175c4276a6742310fd53bb6b87e8.exepid process 3420 1b4f98529066175c4276a6742310fd53bb6b87e8.exe 3420 1b4f98529066175c4276a6742310fd53bb6b87e8.exe