Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
30-08-2023 19:46
General
-
Target
ee596ee5b272255ed519b268fd04111d_icedid_JC.exe
-
Size
268KB
-
MD5
ee596ee5b272255ed519b268fd04111d
-
SHA1
30c77c9ef727388d564506b2cd0820ff01aaea9d
-
SHA256
d3094727983aafc5022694b55e32494b1c4992c1cf84e705365284df63ce3655
-
SHA512
2c876fc8cc454720f668125f7ed0665700afb0f29ba4c88679546ee72ddc2b10926572c595e1c754638c6dff79715a719f49f213945fcf493b60e7b73af0e3dc
-
SSDEEP
3072:hPp5mw6EHinF6vQS+JVKW+HYZtHK4lzIZqnhbvMJ4aiiiiHiiiiiiiiiiiiiiiiq:RmwKE4bJVKQKdZqxBjH4BB3K
Malware Config
Extracted
emotet
Epoch2
12.184.217.101:80
98.150.169.135:80
51.89.36.180:443
64.207.182.168:8080
51.89.199.141:8080
62.171.142.179:8080
27.114.9.93:80
94.200.114.161:80
24.230.141.169:80
190.162.215.233:80
85.105.111.166:80
168.235.67.138:7080
110.142.236.207:80
67.170.250.203:443
184.180.181.202:80
109.116.245.80:80
94.23.237.171:443
76.175.162.101:80
108.46.29.236:80
157.245.99.39:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet payload 3 IoCs
Detects Emotet payload in memory.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee596ee5b272255ed519b268fd04111d_icedid_JC.exe"C:\Users\Admin\AppData\Local\Temp\ee596ee5b272255ed519b268fd04111d_icedid_JC.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1304-0-0x00000000021C0000-0x00000000021D2000-memory.dmpFilesize
72KB
-
memory/1304-1-0x00000000021B0000-0x00000000021BF000-memory.dmpFilesize
60KB
-
memory/1304-5-0x00000000021E0000-0x00000000021F0000-memory.dmpFilesize
64KB