Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
05-02-2024 16:24
General
-
Target
2024-02-05_49f17f82a27017a6d29448e3b4d3e60e_icedid.exe
-
Size
292KB
-
MD5
49f17f82a27017a6d29448e3b4d3e60e
-
SHA1
848ff654b878641cbdef06d405cfe6b53da15533
-
SHA256
69cfd02f34c75b34a03c4234c692626055285e71a8cab6878d98c83e92adb81d
-
SHA512
0e490303e424522579a22a8cec838b30627c665d1ab2c47eb7bbec030c07383d34dde36f2f85db88c44fc9a05a30bcfd7dc271191cfd7332737c57882f226f15
-
SSDEEP
6144:/xvUzHAmeoLfv9dUCOZqUMEtKWV1ioI3xIiPO4UBrfDdt:/xvRmeitOCOU6tPriocdIrfD
Malware Config
Extracted
emotet
Epoch2
47.144.21.37:80
181.171.209.241:443
200.111.198.76:80
185.201.9.197:8080
64.207.182.168:8080
155.186.9.160:80
74.128.121.17:80
78.24.219.147:8080
110.142.236.207:80
72.186.136.247:443
87.106.139.101:8080
119.59.116.21:8080
167.114.153.111:8080
202.134.4.211:8080
58.1.242.115:80
161.0.153.60:80
50.91.114.38:80
62.30.7.67:443
208.74.26.234:80
172.104.97.173:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet payload 3 IoCs
Detects Emotet payload in memory.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-05_49f17f82a27017a6d29448e3b4d3e60e_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-05_49f17f82a27017a6d29448e3b4d3e60e_icedid.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2188-1-0x0000000000260000-0x000000000026F000-memory.dmpFilesize
60KB
-
memory/2188-0-0x0000000000270000-0x0000000000282000-memory.dmpFilesize
72KB
-
memory/2188-5-0x0000000000390000-0x00000000003A0000-memory.dmpFilesize
64KB