Analysis

  • max time kernel
    137s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-04-2024 09:53

General

  • Target

    2024-04-06_dd42c2dda17be426a5069af6daee18ce_icedid.exe

  • Size

    366KB

  • MD5

    dd42c2dda17be426a5069af6daee18ce

  • SHA1

    accf24ab7d242fadf77a7f87ffea4eb4d6a3709f

  • SHA256

    978e925254a2ea08bd3cf5aa0a11fa27a4c68ef43eac48a0b5e4e160bc6252ae

  • SHA512

    1994534ed8d6d46b3bbdb548612ee459b87dd59e09e33c8020b6dd8e09322b74f32bcb8b2429882d6def9ac84689734d3209ba191436a9293d65e9822a1a1e0b

  • SSDEEP

    6144:UQkmnkjT/I+MeJCXmI+M8oIjlRaX+TJ2qcB4QrD/02TjL+e9c:UQl2Me0+M8oII+9uLt9c

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

152.170.108.99:443

99.252.27.6:80

93.148.252.90:80

96.126.121.64:443

104.236.137.72:8080

85.234.143.94:8080

80.85.87.122:8080

2.139.158.136:443

80.11.158.65:8080

79.31.85.103:80

77.55.211.77:8080

96.61.113.203:80

181.198.203.45:443

142.93.114.137:8080

186.15.83.52:8080

181.36.42.205:443

68.183.190.199:8080

159.203.204.126:8080

50.28.51.143:8080

46.101.212.195:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-06_dd42c2dda17be426a5069af6daee18ce_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-06_dd42c2dda17be426a5069af6daee18ce_icedid.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4676
    • C:\Users\Admin\AppData\Local\Temp\2024-04-06_dd42c2dda17be426a5069af6daee18ce_icedid.exe
      --d4354107
      2⤵
      • Suspicious behavior: RenamesItself
      • Suspicious use of SetWindowsHookEx
      PID:1272
  • C:\Windows\SysWOW64\texttotexas.exe
    "C:\Windows\SysWOW64\texttotexas.exe"
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3168
    • C:\Windows\SysWOW64\texttotexas.exe
      --f2710967
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/212-16-0x0000000000E10000-0x0000000000E27000-memory.dmp

    Filesize

    92KB

  • memory/1272-6-0x0000000002080000-0x0000000002097000-memory.dmp

    Filesize

    92KB

  • memory/3168-11-0x0000000000D80000-0x0000000000D97000-memory.dmp

    Filesize

    92KB

  • memory/4676-0-0x00000000022E0000-0x00000000022F7000-memory.dmp

    Filesize

    92KB

  • memory/4676-5-0x00000000022C0000-0x00000000022D1000-memory.dmp

    Filesize

    68KB