Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
-
submitted
31-07-2022 05:21
General
-
Target
rimidkjf.exe
-
Size
840KB
-
MD5
406ac12181bdbb42a750ef38545afe02
-
SHA1
7f51b30226520b2e6865ed808bc1d01dd64d78cc
-
SHA256
fdc0245a18ce0dabe29c6ae596c7ca4144778923f71712f27c0f53b4114c2b1a
-
SHA512
b80274c1cc8a2db6a70317b9cf557d083d39d45725af93dda855c00bb8ac45d4c37aa711c3e10b706826727646ce1fce4516ad80df035bebf736bf77b8e022bd
Malware Config
Extracted
emotet
Epoch1
197.245.25.228:80
98.103.204.12:443
59.148.253.194:8080
173.212.197.71:8080
87.106.46.107:8080
50.28.51.143:8080
177.73.0.98:443
213.197.182.158:8080
185.94.252.12:80
189.223.16.99:80
5.189.178.202:8080
186.103.141.250:443
181.129.96.162:8080
190.101.156.139:80
46.105.114.137:8080
51.15.7.145:80
98.13.75.196:80
202.134.4.210:7080
104.131.41.185:8080
181.123.6.86:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet payload 3 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rimidkjf.exe"C:\Users\Admin\AppData\Local\Temp\rimidkjf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1308-54-0x0000000075681000-0x0000000075683000-memory.dmpFilesize
8KB
-
memory/1308-55-0x0000000000270000-0x0000000000288000-memory.dmpFilesize
96KB
-
memory/1308-59-0x00000000003C0000-0x00000000003D7000-memory.dmpFilesize
92KB
-
memory/1308-63-0x0000000000250000-0x0000000000266000-memory.dmpFilesize
88KB