Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
21-02-2024 17:22
General
-
Target
2024-02-21_0d80d2665beb62b25ec2c8c895586d74_icedid.exe
-
Size
292KB
-
MD5
0d80d2665beb62b25ec2c8c895586d74
-
SHA1
1a032fa2bfe4f8aa71e468176258b71e4ec31060
-
SHA256
e813dff317de7d0190625bd299eb859814e4170e752d757d4a5d33d6970e0229
-
SHA512
1211b7cafe9cd40a3efd9fb0118dd200dd52610a6ef547c5ae10c1a757395f2e3ae1822b07f2e48b6e252fc211bcfecf9014fae9344ec37a352e47c0b397fb3f
-
SSDEEP
3072:TyDDt+sqWE654G+COT7xNyH0kB0Vzw/BlC5Igu86XBfL3BEcB4K5QvvQ2Uzai:wt+bYHnOT9hc0VEAIgu8m52Mx5QvM
Malware Config
Extracted
emotet
Epoch3
190.192.39.136:80
5.189.168.53:8080
162.241.41.111:7080
190.85.46.52:7080
190.190.15.20:80
181.95.133.104:80
41.212.89.128:80
115.176.16.221:80
143.95.101.72:8080
75.127.14.170:8080
116.202.10.123:8080
74.208.173.91:8080
103.93.220.182:80
50.116.78.109:8080
67.121.104.51:20
180.26.62.115:443
139.59.12.63:8080
76.18.16.210:80
113.161.148.81:80
5.79.70.250:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet payload 3 IoCs
Detects Emotet payload in memory.
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-21_0d80d2665beb62b25ec2c8c895586d74_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-21_0d80d2665beb62b25ec2c8c895586d74_icedid.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wshbth\qcap.exe"C:\Windows\SysWOW64\wshbth\qcap.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\wshbth\qcap.exeFilesize
292KB
MD50d80d2665beb62b25ec2c8c895586d74
SHA11a032fa2bfe4f8aa71e468176258b71e4ec31060
SHA256e813dff317de7d0190625bd299eb859814e4170e752d757d4a5d33d6970e0229
SHA5121211b7cafe9cd40a3efd9fb0118dd200dd52610a6ef547c5ae10c1a757395f2e3ae1822b07f2e48b6e252fc211bcfecf9014fae9344ec37a352e47c0b397fb3f
-
memory/1400-0-0x0000000000230000-0x0000000000242000-memory.dmpFilesize
72KB
-
memory/1400-2-0x0000000000220000-0x000000000022F000-memory.dmpFilesize
60KB
-
memory/1400-5-0x0000000000250000-0x0000000000260000-memory.dmpFilesize
64KB