Analysis
-
max time kernel
144s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
06-01-2024 10:16
General
-
Target
5c1eb2104efddbf6dd8ec89fb57df5d7.exe
-
Size
348KB
-
MD5
5c1eb2104efddbf6dd8ec89fb57df5d7
-
SHA1
4e190accabaefbc887b11b9e21d56accbdacd775
-
SHA256
09fc36c979db3d6f456c9b00982bfda8cc08516bc9bdb59fed72e458001d0a64
-
SHA512
11b20c6004d09f5374bee0f2b5d6a9ab224915c3fa1ebbf75b65cdb5f1e279628ce8933668cbbf6325649fb9006dcfdf28294ef8f22a857831be82fbdd41f297
-
SSDEEP
6144:RhUemQcYyGKa0qXpZ/vexQ+y3mrUZPJ3hgNhAuoEiaN:dyU0Qd+GmJhbH
Malware Config
Extracted
emotet
Epoch1
81.213.175.132:80
79.118.72.250:80
172.245.248.239:8080
54.36.185.60:80
202.79.24.136:443
82.208.149.146:80
190.114.254.163:8080
186.146.13.184:443
170.81.48.2:80
177.144.130.105:443
190.251.216.100:80
113.163.216.135:80
192.232.229.53:4143
190.45.24.210:80
70.32.84.74:8080
51.255.165.160:8080
103.236.179.162:80
81.214.253.80:443
62.84.75.50:80
74.58.215.226:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet payload 3 IoCs
Detects Emotet payload in memory.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c1eb2104efddbf6dd8ec89fb57df5d7.exe"C:\Users\Admin\AppData\Local\Temp\5c1eb2104efddbf6dd8ec89fb57df5d7.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1948-1-0x0000000000610000-0x000000000061F000-memory.dmpFilesize
60KB
-
memory/1948-5-0x0000000000620000-0x0000000000630000-memory.dmpFilesize
64KB
-
memory/1948-0-0x0000000001C50000-0x0000000001C62000-memory.dmpFilesize
72KB