Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
04-08-2023 03:59
General
-
Target
359fe0d7084c4e7084d92adab7ce7f9a2f520cbfb411cb41892d0ef654ee4fed.exe
-
Size
296KB
-
MD5
a2d9e507715673be3509269f337939f8
-
SHA1
65c25db59d5e1c8cf0c6d58ee497698677b6ae14
-
SHA256
359fe0d7084c4e7084d92adab7ce7f9a2f520cbfb411cb41892d0ef654ee4fed
-
SHA512
f04a03622ca17014d8ba11cbbbd5369ed1103aa48e554a171143ee68223f8e45914fbb040e24f700e2e903faa6f4456017d57afc154f8a331c4273a25a4b52c4
-
SSDEEP
6144:zLTQdXfZ1XRcD6aJbHBZHfIXc5fmZ7tm0eg8vQ:zfEXfZ1aD6aJbh7q7tm0ePv
Malware Config
Extracted
emotet
Epoch2
12.30.50.130:80
120.138.30.150:8080
139.59.67.118:443
94.23.216.33:80
70.121.172.89:80
139.130.242.43:80
83.169.36.251:8080
89.205.113.80:80
24.137.76.62:80
201.173.217.124:443
87.106.136.232:8080
173.62.217.22:443
78.24.219.147:8080
190.55.181.54:443
85.152.162.105:80
24.179.13.119:80
139.59.60.244:8080
95.179.229.244:8080
162.241.242.173:8080
137.119.36.33:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet payload 3 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\359fe0d7084c4e7084d92adab7ce7f9a2f520cbfb411cb41892d0ef654ee4fed.exe"C:\Users\Admin\AppData\Local\Temp\359fe0d7084c4e7084d92adab7ce7f9a2f520cbfb411cb41892d0ef654ee4fed.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2572-54-0x0000000000240000-0x0000000000252000-memory.dmpFilesize
72KB
-
memory/2572-59-0x0000000000260000-0x0000000000270000-memory.dmpFilesize
64KB
-
memory/2572-55-0x0000000000230000-0x000000000023F000-memory.dmpFilesize
60KB