Analysis
-
max time kernel
129s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
29-07-2023 13:24
General
-
Target
df4cd33545463aex_JC.exe
-
Size
416KB
-
MD5
df4cd33545463afd0109de0c4c020fb3
-
SHA1
4c298bd8303b4d15d3ed36044338993b8874e0cb
-
SHA256
c4a9cdaf9176ecd0831b77f82a20c625d45daf2cf4a969411e8747de361012b8
-
SHA512
b7f44f690c0352ad9693fb725e71c589c653297263fd24e6bf5464df0f21e9fbe497c49383c1afc12b947ea498d664bcd91ffd30aeb114d4bc2ec6a9bef143d9
-
SSDEEP
6144:p5f/WPWZH9T3nMmAYjjQl0iNx3Q6cbiP8dq8f3pfdDBWRqMr9kYqvTd39aQ:7HWP2dT3nXDj4FNPYBlD/aQ
Malware Config
Extracted
emotet
Epoch2
96.252.116.33:80
110.145.11.73:80
185.201.9.197:8080
64.207.182.168:8080
51.89.36.180:443
208.74.26.234:80
89.216.122.92:80
190.164.104.62:80
62.75.141.82:80
94.230.70.6:80
37.187.72.193:8080
72.186.136.247:443
138.68.87.218:443
120.150.60.189:80
24.69.65.8:8080
110.142.236.207:80
74.208.45.104:8080
113.61.66.94:80
74.128.121.17:80
110.145.101.66:443
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet payload 3 IoCs
Detects Emotet payload in memory.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\df4cd33545463aex_JC.exe"C:\Users\Admin\AppData\Local\Temp\df4cd33545463aex_JC.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2488-54-0x0000000000230000-0x000000000023F000-memory.dmpFilesize
60KB
-
memory/2488-53-0x0000000000340000-0x0000000000352000-memory.dmpFilesize
72KB
-
memory/2488-58-0x00000000002D0000-0x00000000002E0000-memory.dmpFilesize
64KB