Analysis
-
max time kernel
150s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
26-07-2023 15:23
General
-
Target
NA_NA_NA_NA_9008dd6bcdafc1ex_JC.exe
-
Size
354KB
-
MD5
9008dd6bcdafc11feff444767f5e46c2
-
SHA1
09d4d2d00e31c7700aa66bd08e199b9120d0a130
-
SHA256
eb1c0b6a8cf34c3e093758372ba1e6024b301b4282ee9341f6aee1d51c770c04
-
SHA512
6d5cd8af9fd09f6d81c8e3d0d4d1f91a30dbd3f8e4a4e4982551bfbcb6b056a5e0ff1360107e912d08f258ff1f0d6aed5b72037222ebbe13e37b2674630ca0ce
-
SSDEEP
6144:VQgy+hgystnyl40dvNk6JAkfGmIIuQsLeR937uZXIUlt0fCRPV:Xstnyl40cAGmI2NR9qXIMN
Malware Config
Extracted
emotet
Epoch2
72.27.212.209:8080
172.125.40.123:80
185.201.9.197:8080
64.207.182.168:8080
51.89.36.180:443
24.179.13.119:80
142.112.10.95:20
100.37.240.62:80
173.173.254.105:80
190.29.166.0:80
37.187.72.193:8080
194.4.58.192:7080
109.74.5.95:8080
172.86.188.251:8080
67.10.155.92:80
209.141.54.221:7080
202.134.4.211:8080
172.91.208.86:80
220.245.198.194:80
120.150.218.241:443
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet payload 3 IoCs
Detects Emotet payload in memory.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NA_NA_NA_NA_9008dd6bcdafc1ex_JC.exe"C:\Users\Admin\AppData\Local\Temp\NA_NA_NA_NA_9008dd6bcdafc1ex_JC.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4684-134-0x0000000002430000-0x0000000002442000-memory.dmpFilesize
72KB
-
memory/4684-133-0x00000000023E0000-0x00000000023EF000-memory.dmpFilesize
60KB
-
memory/4684-138-0x0000000002450000-0x0000000002460000-memory.dmpFilesize
64KB