Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
11-07-2022 08:53
Static task
static1
Behavioral task
behavioral1
Sample
1911f736d8970cc9fd5c6ad9b37ef2d259b01b54.exe
Resource
win7-20220414-en
General
-
Target
1911f736d8970cc9fd5c6ad9b37ef2d259b01b54.exe
-
Size
400KB
-
MD5
6630cddbe93c8c6b7cf2457cf09ed587
-
SHA1
1911f736d8970cc9fd5c6ad9b37ef2d259b01b54
-
SHA256
5c6b3fa21edceeb05e50540d3a637934876eed80b90a9515e18de2860451322f
-
SHA512
0c8295c2087f5dfab53a8c397c363c60c568cf7d4264eb2c480bed2356d65cb01cc4b2283c134069af9b8ab17c20bf620ca004ee1af918d2e9726a99ff2bd8c4
Malware Config
Extracted
emotet
Epoch1
190.202.229.74:80
118.69.11.81:7080
70.39.251.94:8080
87.230.25.43:8080
94.23.62.116:8080
37.187.161.206:8080
45.46.37.97:80
138.97.60.141:7080
177.144.130.105:8080
169.1.39.242:80
209.236.123.42:8080
202.134.4.210:7080
193.251.77.110:80
2.45.176.233:80
217.13.106.14:8080
189.223.16.99:80
190.101.156.139:80
77.238.212.227:80
181.58.181.9:80
37.183.81.217:80
74.58.215.226:80
174.118.202.24:443
168.197.45.36:80
81.215.230.173:443
192.175.111.212:7080
216.47.196.104:80
128.92.203.42:80
94.176.234.118:443
191.182.6.118:80
212.71.237.140:8080
24.232.228.233:80
177.73.0.98:443
177.23.7.151:80
24.135.69.146:80
83.169.21.32:7080
189.34.181.88:80
179.222.115.170:80
177.144.130.105:443
213.197.182.158:8080
5.89.33.136:80
77.78.196.173:443
120.72.18.91:80
50.28.51.143:8080
190.64.88.186:443
111.67.12.221:8080
12.162.84.2:8080
46.105.114.137:8080
59.148.253.194:8080
201.213.177.139:80
82.76.52.155:80
172.104.169.32:8080
188.251.213.180:80
46.43.2.95:8080
137.74.106.111:7080
188.135.15.49:80
185.94.252.27:443
197.232.36.108:80
60.249.78.226:8080
187.162.248.237:80
181.129.96.162:8080
46.101.58.37:8080
109.242.153.9:80
178.211.45.66:8080
200.59.6.174:80
83.103.179.156:80
172.86.186.21:8080
70.32.115.157:8080
81.214.253.80:443
201.49.239.200:443
149.202.72.142:7080
190.45.24.210:80
186.189.249.2:80
219.92.13.25:80
170.81.48.2:80
51.75.33.127:80
192.241.143.52:8080
45.33.77.42:8080
152.169.22.67:80
185.183.16.47:80
186.70.127.199:8090
1.226.84.243:8080
78.206.229.130:80
37.179.145.105:80
68.183.170.114:8080
192.232.229.54:7080
103.236.179.162:80
70.32.84.74:8080
79.118.74.90:80
60.93.23.51:80
181.120.29.49:80
213.52.74.198:80
51.255.165.160:8080
183.176.82.231:80
186.193.229.123:80
98.103.204.12:443
129.232.220.11:8080
181.61.182.143:80
68.183.190.199:8080
190.115.18.139:8080
200.24.255.23:80
103.13.224.53:80
85.214.26.7:8080
190.24.243.186:80
87.106.46.107:8080
177.107.79.214:8080
12.163.208.58:80
187.162.250.23:443
109.101.137.162:8080
82.76.111.249:443
181.30.61.163:443
5.196.35.138:7080
51.15.7.145:80
192.198.91.138:443
188.157.101.114:80
189.2.177.210:443
181.123.6.86:80
109.190.35.249:80
45.16.226.117:443
190.190.219.184:80
104.131.41.185:8080
101.187.81.254:80
62.84.75.50:80
178.250.54.208:8080
201.71.228.86:80
190.92.122.226:80
138.97.60.140:8080
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4996-133-0x00000000022A0000-0x00000000022B0000-memory.dmp emotet -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
1911f736d8970cc9fd5c6ad9b37ef2d259b01b54.exepid process 4996 1911f736d8970cc9fd5c6ad9b37ef2d259b01b54.exe 4996 1911f736d8970cc9fd5c6ad9b37ef2d259b01b54.exe 4996 1911f736d8970cc9fd5c6ad9b37ef2d259b01b54.exe 4996 1911f736d8970cc9fd5c6ad9b37ef2d259b01b54.exe 4996 1911f736d8970cc9fd5c6ad9b37ef2d259b01b54.exe 4996 1911f736d8970cc9fd5c6ad9b37ef2d259b01b54.exe 4996 1911f736d8970cc9fd5c6ad9b37ef2d259b01b54.exe 4996 1911f736d8970cc9fd5c6ad9b37ef2d259b01b54.exe 4996 1911f736d8970cc9fd5c6ad9b37ef2d259b01b54.exe 4996 1911f736d8970cc9fd5c6ad9b37ef2d259b01b54.exe 4996 1911f736d8970cc9fd5c6ad9b37ef2d259b01b54.exe 4996 1911f736d8970cc9fd5c6ad9b37ef2d259b01b54.exe 4996 1911f736d8970cc9fd5c6ad9b37ef2d259b01b54.exe 4996 1911f736d8970cc9fd5c6ad9b37ef2d259b01b54.exe 4996 1911f736d8970cc9fd5c6ad9b37ef2d259b01b54.exe 4996 1911f736d8970cc9fd5c6ad9b37ef2d259b01b54.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
1911f736d8970cc9fd5c6ad9b37ef2d259b01b54.exepid process 4996 1911f736d8970cc9fd5c6ad9b37ef2d259b01b54.exe 4996 1911f736d8970cc9fd5c6ad9b37ef2d259b01b54.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4996-133-0x00000000022A0000-0x00000000022B0000-memory.dmpFilesize
64KB