Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
05-02-2024 16:22
General
-
Target
2024-02-05_048f19cbfe92d7c364da742c2ab700e4_icedid.exe
-
Size
385KB
-
MD5
048f19cbfe92d7c364da742c2ab700e4
-
SHA1
4cc43763f35011837ac1eaff965de4887a822bfd
-
SHA256
798b13a65f61210e96d246d5e8f797eec0c0bc4b856856bc36f753c7ff8718e7
-
SHA512
a592a30c7ac75778145fbb9dfe299c41c63f2dbfc6d6b80a3933da336913667ee0de375685818c9c55833beaa5328c9184df5378777b4013bfc5c54354e75e07
-
SSDEEP
6144:it4XJh2c4kgKO0mUv8+LfXXMrUzM43IGQePKSQqEP90/0eeBpT:ibKO0TPDIUzM43IkKgEP90/7ev
Malware Config
Extracted
emotet
Epoch2
49.205.182.134:80
72.229.97.235:80
188.165.214.98:8080
185.201.9.197:8080
64.207.182.168:8080
5.39.91.110:7080
155.186.9.160:80
24.178.90.49:80
157.245.99.39:8080
174.118.202.24:443
50.246.154.69:80
79.137.83.50:443
110.145.11.73:80
190.29.166.0:80
176.111.60.55:8080
24.69.65.8:8080
46.105.131.79:8080
62.30.7.67:443
172.125.40.123:80
209.141.54.221:7080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet payload 3 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-05_048f19cbfe92d7c364da742c2ab700e4_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-05_048f19cbfe92d7c364da742c2ab700e4_icedid.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1096-0-0x0000000001C40000-0x0000000001C52000-memory.dmpFilesize
72KB
-
memory/1096-4-0x0000000001C20000-0x0000000001C30000-memory.dmpFilesize
64KB
-
memory/1096-7-0x00000000003F0000-0x00000000003FF000-memory.dmpFilesize
60KB