Analysis
-
max time kernel
139s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22-01-2024 06:25
Static task
static1
Behavioral task
behavioral1
Sample
6ef4952ed7a2a14dcd4a729dc9feac7e.exe
Resource
win7-20231215-en
General
-
Target
6ef4952ed7a2a14dcd4a729dc9feac7e.exe
-
Size
238KB
-
MD5
6ef4952ed7a2a14dcd4a729dc9feac7e
-
SHA1
e3050fa75a64c20d01a91f80fc17f9c943103fda
-
SHA256
b225fa439799aa17f19ecef9407f360d238bf574eceb75cb52dd249b85db7e3e
-
SHA512
e8ba91b3ff8d958d6f5050ecbcd2c4f6a551ad4388641d33af56251447fd27e7ef59e1e8cd555c1d60df2a8f63c0e7bca086ead3c5548c5449485499070d0410
-
SSDEEP
3072:qtZJ0spZady+KI+DLd7wNJfgnzNgy8MRNFKTOfQu0TQ1R:qtZJ08AdAISL6/Y9RDKGQNQ1R
Malware Config
Extracted
emotet
Epoch2
24.43.32.186:80
38.111.46.46:8080
134.209.36.254:8080
162.241.242.173:8080
74.120.55.163:80
61.92.17.12:80
219.74.18.66:443
156.155.166.221:80
104.131.44.150:8080
37.139.21.175:8080
94.1.108.190:443
169.239.182.217:8080
220.245.198.194:80
139.99.158.11:443
91.211.88.52:7080
62.75.141.82:80
174.45.13.118:80
137.119.36.33:80
188.219.31.12:80
103.86.49.11:8080
104.131.11.150:443
124.41.215.226:80
78.187.156.31:80
104.32.141.43:80
47.144.21.12:443
93.147.212.206:80
200.123.150.89:443
121.7.127.163:80
200.114.213.233:8080
94.200.114.161:80
24.179.13.119:80
84.39.182.7:80
97.82.79.83:80
87.106.136.232:8080
5.196.74.210:8080
24.43.99.75:80
213.196.135.145:80
94.23.237.171:443
74.134.41.124:80
96.249.236.156:443
95.213.236.64:8080
137.59.187.107:8080
75.139.38.211:80
82.225.49.121:80
123.176.25.234:80
194.187.133.160:443
62.30.7.67:443
109.74.5.95:8080
176.111.60.55:8080
24.137.76.62:80
37.187.72.193:8080
110.145.77.103:80
153.137.36.142:80
1.221.254.82:80
195.7.12.8:80
110.5.16.198:80
185.94.252.104:443
104.236.246.93:8080
78.24.219.147:8080
85.152.162.105:80
85.105.205.77:8080
139.59.60.244:8080
79.137.83.50:443
50.91.114.38:80
172.91.208.86:80
74.219.172.26:80
83.169.36.251:8080
153.232.188.106:80
209.141.54.221:8080
168.235.67.138:7080
139.130.242.43:80
121.124.124.40:7080
89.216.122.92:80
203.153.216.189:7080
187.161.206.24:80
157.245.99.39:8080
195.251.213.56:80
71.72.196.159:80
174.102.48.180:443
181.169.34.190:80
140.186.212.146:80
201.173.217.124:443
42.200.107.142:80
79.98.24.39:8080
5.39.91.110:7080
139.162.108.71:8080
74.208.45.104:8080
61.19.246.238:443
50.35.17.13:80
95.179.229.244:8080
216.139.123.119:80
120.150.60.189:80
219.75.128.166:80
68.188.112.97:80
107.5.122.110:80
87.106.139.101:8080
46.105.131.79:8080
82.80.155.43:80
Signatures
-
Processes:
resource yara_rule behavioral2/memory/2252-1-0x0000000000A40000-0x0000000000A52000-memory.dmp emotet behavioral2/memory/2252-7-0x0000000000A30000-0x0000000000A3F000-memory.dmp emotet behavioral2/memory/2252-5-0x0000000000A60000-0x0000000000A70000-memory.dmp emotet -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
6ef4952ed7a2a14dcd4a729dc9feac7e.exepid process 2252 6ef4952ed7a2a14dcd4a729dc9feac7e.exe 2252 6ef4952ed7a2a14dcd4a729dc9feac7e.exe 2252 6ef4952ed7a2a14dcd4a729dc9feac7e.exe 2252 6ef4952ed7a2a14dcd4a729dc9feac7e.exe 2252 6ef4952ed7a2a14dcd4a729dc9feac7e.exe 2252 6ef4952ed7a2a14dcd4a729dc9feac7e.exe 2252 6ef4952ed7a2a14dcd4a729dc9feac7e.exe 2252 6ef4952ed7a2a14dcd4a729dc9feac7e.exe 2252 6ef4952ed7a2a14dcd4a729dc9feac7e.exe 2252 6ef4952ed7a2a14dcd4a729dc9feac7e.exe 2252 6ef4952ed7a2a14dcd4a729dc9feac7e.exe 2252 6ef4952ed7a2a14dcd4a729dc9feac7e.exe 2252 6ef4952ed7a2a14dcd4a729dc9feac7e.exe 2252 6ef4952ed7a2a14dcd4a729dc9feac7e.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2252-0-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2252-1-0x0000000000A40000-0x0000000000A52000-memory.dmpFilesize
72KB
-
memory/2252-7-0x0000000000A30000-0x0000000000A3F000-memory.dmpFilesize
60KB
-
memory/2252-5-0x0000000000A60000-0x0000000000A70000-memory.dmpFilesize
64KB