Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
-
submitted
31-07-2022 05:23
General
-
Target
tgwbgggc.exe
-
Size
361KB
-
MD5
59c99c0fc4184d2d5e9b6772262a19cc
-
SHA1
10abdb7d7a54de2fe34a21253903cf6dd4821d03
-
SHA256
3c1d3f81ebcc0000c838b73398fc229e5d81e00e5c7924e9e92a929b62e7fc97
-
SHA512
5710e088c47249ff3d19eae9434c6a1e6c9af7dc77b555918e81e1d31aa46b60893f818f292b4d906575f610f13b309c37bf436fce0f0ceedb62c651e154f2b7
Malware Config
Extracted
emotet
Epoch1
2.45.176.233:80
98.103.204.12:443
172.86.186.21:8080
192.175.111.214:8080
109.190.249.106:80
177.144.130.105:8080
70.32.84.74:8080
192.81.38.31:80
138.97.60.140:8080
189.223.16.99:80
175.143.12.123:8080
190.115.18.139:8080
170.81.48.2:80
5.196.35.138:7080
172.104.169.32:8080
178.250.54.208:8080
185.94.252.27:443
46.105.114.137:8080
79.118.74.90:80
70.169.17.134:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet payload 3 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tgwbgggc.exe"C:\Users\Admin\AppData\Local\Temp\tgwbgggc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1752-54-0x0000000000330000-0x000000000034C000-memory.dmpFilesize
112KB
-
memory/1752-58-0x00000000003D0000-0x00000000003EB000-memory.dmpFilesize
108KB
-
memory/1752-62-0x0000000075DF1000-0x0000000075DF3000-memory.dmpFilesize
8KB
-
memory/1752-63-0x0000000000310000-0x000000000032A000-memory.dmpFilesize
104KB