Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
05-02-2024 16:27
General
-
Target
2024-02-05_f86297e4942ac389f8e1659511f6c88d_icedid.exe
-
Size
340KB
-
MD5
f86297e4942ac389f8e1659511f6c88d
-
SHA1
24c6e26e841f6d20565a059e6b10d1c216b6c87d
-
SHA256
83b6a7fed84ef1bf8868e8c73a86ef3d224b695e16d5c50647a53a88cefc7e91
-
SHA512
b672f254ed1339e472c8c965c6156bca15bab67a8d71c13fbbae964d01fbb2385e4974899197eaaa862fed65fa446cba4e13c0df8d1130308a4c30638a1f36e5
-
SSDEEP
6144:fcfe70CBlX7tmbBMY62Kb9ykhRYAr76Ky7MFjWPVxZK:0fSX7qBMY62Kb9JYArLqXI
Malware Config
Extracted
emotet
Epoch2
50.246.154.69:80
58.1.242.115:80
200.111.198.76:80
185.201.9.197:8080
64.207.182.168:8080
168.235.67.138:7080
202.134.4.216:8080
155.186.9.160:80
201.241.127.190:80
139.99.158.11:443
5.2.212.254:80
72.186.136.247:443
120.150.218.241:443
119.59.116.21:8080
62.171.142.179:8080
2.58.16.89:8080
62.30.7.67:443
190.146.92.48:80
136.244.110.184:8080
138.68.87.218:443
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet payload 3 IoCs
Detects Emotet payload in memory.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-05_f86297e4942ac389f8e1659511f6c88d_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-05_f86297e4942ac389f8e1659511f6c88d_icedid.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2212-0-0x00000000002E0000-0x00000000002F2000-memory.dmpFilesize
72KB
-
memory/2212-2-0x0000000000250000-0x000000000025F000-memory.dmpFilesize
60KB
-
memory/2212-5-0x0000000000270000-0x0000000000280000-memory.dmpFilesize
64KB