Analysis
-
max time kernel
30s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
19-05-2023 19:36
General
-
Target
0b28dc6f12d3b18d40afb250d8f20cfc8a85d05c77e86512c9f2f83ec8c3c225.exe
-
Size
652KB
-
MD5
757b6e8f8643819e0405c48b041fae65
-
SHA1
bd61c6e1892e465464a8ee74e0031f79bdeec548
-
SHA256
0b28dc6f12d3b18d40afb250d8f20cfc8a85d05c77e86512c9f2f83ec8c3c225
-
SHA512
a92effcc3aa2c52821da00b543b25603606c17e56c7ed02424e67ad1c36e74bab69d94236d1d054e93de4bc43166ed96757b8a77aa165b072ef5afc09355aab6
-
SSDEEP
12288:/v2US3BEc0hCxUoBm6c+qrbCucwWHRJFfA++8L:GUSxEXhpl62rbDQRJFB
Malware Config
Extracted
emotet
Epoch2
74.75.104.224:80
201.184.105.242:443
51.89.36.180:443
64.207.182.168:8080
51.89.199.141:8080
109.116.245.80:80
24.178.90.49:80
12.184.217.101:80
172.86.188.251:8080
217.20.166.178:7080
123.176.25.234:80
76.175.162.101:80
79.137.83.50:443
190.29.166.0:80
113.61.66.94:80
134.209.144.106:443
139.162.60.124:8080
108.46.29.236:80
182.208.30.18:443
88.153.35.32:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet payload 3 IoCs
Detects Emotet payload in memory.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b28dc6f12d3b18d40afb250d8f20cfc8a85d05c77e86512c9f2f83ec8c3c225.exe"C:\Users\Admin\AppData\Local\Temp\0b28dc6f12d3b18d40afb250d8f20cfc8a85d05c77e86512c9f2f83ec8c3c225.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/916-54-0x0000000000250000-0x0000000000262000-memory.dmpFilesize
72KB
-
memory/916-58-0x00000000001C0000-0x00000000001D0000-memory.dmpFilesize
64KB
-
memory/916-62-0x00000000001B0000-0x00000000001BF000-memory.dmpFilesize
60KB