Analysis
-
max time kernel
133s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
21-08-2023 18:07
General
-
Target
652194b60ed8d125763a56d43c94362f_icedid_JC.exe
-
Size
268KB
-
MD5
652194b60ed8d125763a56d43c94362f
-
SHA1
a973fda3b9802ea5e6e6e1700dc8912426d49e82
-
SHA256
31df957666f0b7c3b9602b1ae8a13ee2aceedf8b8a8f90105e67dbcc097a190b
-
SHA512
f2eedceb1823609bd4f99984d813817e775f2b6749b9f3f7c9f74da30306b74afbe52baff0575941b747dbe015d1a2bf03b8ae038d0cb0a6c22042cd4b34c30a
-
SSDEEP
3072:r5XcTfcrVXLbezrMM2grlVkDKl8yytsHK4lzIZqnhbvMJ4aiiiiHiiiiiiiiiii1:AfQm8M2IlVAttndZqxBjH4BB3K
Malware Config
Extracted
emotet
Epoch2
12.184.217.101:80
98.150.169.135:80
51.89.36.180:443
64.207.182.168:8080
51.89.199.141:8080
62.171.142.179:8080
27.114.9.93:80
94.200.114.161:80
24.230.141.169:80
190.162.215.233:80
85.105.111.166:80
168.235.67.138:7080
110.142.236.207:80
67.170.250.203:443
184.180.181.202:80
109.116.245.80:80
94.23.237.171:443
76.175.162.101:80
108.46.29.236:80
157.245.99.39:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet payload 3 IoCs
Detects Emotet payload in memory.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\652194b60ed8d125763a56d43c94362f_icedid_JC.exe"C:\Users\Admin\AppData\Local\Temp\652194b60ed8d125763a56d43c94362f_icedid_JC.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2268-54-0x0000000000230000-0x0000000000242000-memory.dmpFilesize
72KB
-
memory/2268-56-0x0000000000220000-0x000000000022F000-memory.dmpFilesize
60KB
-
memory/2268-59-0x0000000000250000-0x0000000000260000-memory.dmpFilesize
64KB