Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
27-11-2023 06:02
General
-
Target
b93593634d983b7582c24b823ead4462_icedid_JC.exe
-
Size
220KB
-
MD5
b93593634d983b7582c24b823ead4462
-
SHA1
e38d96899d6741de6773ed6df4dc1ed4bbf52eeb
-
SHA256
f147e9229940c3502a256ea62ffbb1adfe4174a3ee92c3c368cde67c91267b93
-
SHA512
01546deceed32c54851a4dbae8139166aba39ae5ddfe10b0700dc005001b390d1dce44c1aa69ad58425309a01ea731ffc6e163c682e0aae5e0fe4c75f59bfa62
-
SSDEEP
3072:EmNNdj/2Mjx79Px+hV4WAWkAefotUroOblNvaPwu7ckAzGxAK04RPa+o9JoXD:fnr2MjRPjxWvegcHPaPl7creAyRPLor
Malware Config
Extracted
emotet
Epoch1
12.163.208.58:80
45.33.35.74:8080
87.106.253.248:8080
192.241.146.84:8080
190.115.18.139:8080
65.36.62.20:80
170.81.48.2:80
83.169.21.32:7080
185.232.182.218:80
190.2.31.172:80
77.106.157.34:8080
82.230.1.24:80
202.4.58.197:80
201.213.177.139:80
78.249.119.122:80
123.51.47.18:80
77.90.136.129:8080
60.93.23.51:80
152.169.22.67:80
190.117.79.209:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet payload 3 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 33 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b93593634d983b7582c24b823ead4462_icedid_JC.exe"C:\Users\Admin\AppData\Local\Temp\b93593634d983b7582c24b823ead4462_icedid_JC.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2236-0-0x00000000003B0000-0x00000000003C2000-memory.dmpFilesize
72KB
-
memory/2236-5-0x00000000003D0000-0x00000000003E0000-memory.dmpFilesize
64KB
-
memory/2236-1-0x00000000003A0000-0x00000000003AF000-memory.dmpFilesize
60KB