Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
21-05-2024 08:20
General
-
Target
20b6ccac3d46bc6396c229f739cdcc7cd8eb316cae3faf6c0ef64b2a2f3616ee_NeikiAnalytics.exe
-
Size
116KB
-
MD5
5a7a6bf6472ca172c43dd183388af44b
-
SHA1
0bb7cfd6cb165563002206482e68031e83001128
-
SHA256
20b6ccac3d46bc6396c229f739cdcc7cd8eb316cae3faf6c0ef64b2a2f3616ee
-
SHA512
e0a57b589a3e84df14c7b2939253c10898bcaa7adf78eb950b9f98735b7503c5e63e8e44fed0acf4eaf14a429e8abc21c9da0bc1517360c9106d5fdbe5d77755
-
SSDEEP
3072:HChC6NAN/FuTmngEyyIVVoyCVGp1bnrGL0Tk6:H0CTN/gTagEyx/6GX40Tk
Malware Config
Extracted
emotet
Epoch3
118.2.218.1:80
51.254.140.91:7080
5.9.227.244:8080
51.75.163.68:7080
75.127.14.170:8080
101.50.232.218:80
175.139.144.229:8080
139.59.12.63:8080
2.144.244.204:443
175.29.183.2:80
86.98.143.163:80
210.1.219.238:80
73.84.105.76:80
185.208.226.142:8080
91.75.75.46:80
188.251.213.180:443
88.249.181.198:443
77.74.78.80:443
181.137.229.1:80
190.136.179.102:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\20b6ccac3d46bc6396c229f739cdcc7cd8eb316cae3faf6c0ef64b2a2f3616ee_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\20b6ccac3d46bc6396c229f739cdcc7cd8eb316cae3faf6c0ef64b2a2f3616ee_NeikiAnalytics.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4068-0-0x00000000006D0000-0x00000000006DC000-memory.dmpFilesize
48KB
-
memory/4068-4-0x00000000005B0000-0x00000000005B9000-memory.dmpFilesize
36KB
-
memory/4068-5-0x00000000006D0000-0x00000000006DC000-memory.dmpFilesize
48KB
-
memory/4068-6-0x0000000000570000-0x00000000005A2000-memory.dmpFilesize
200KB