Analysis
-
max time kernel
132s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
21-05-2024 12:02
General
-
Target
4609c19a333114a5786ed22f4ba0694f0cd89d954661f945fdc4b71c9fe0bb47_NeikiAnalytics.exe
-
Size
156KB
-
MD5
5dd02e7beb92910cc1f3c3a8159a4b2f
-
SHA1
d589ca6da5c25ecfea0f7f2ece6fd20ae02a130c
-
SHA256
4609c19a333114a5786ed22f4ba0694f0cd89d954661f945fdc4b71c9fe0bb47
-
SHA512
cc72aa3dcb3553acc0f49f485241252bbb59e7d55d829f52479fec786057b6570d3d9d673ea11e6b2bce0c8f9826d561cf8da060c2f342a8b6ffea6b01aa1f5c
-
SSDEEP
3072:fE8Hiuuq5zv1PlPQ9vj/t+VeFZ7JamJp2Lom9OTHk1:fXuqlPQ9vjF+wZsgmj
Malware Config
Extracted
emotet
Epoch1
50.121.220.50:80
51.75.33.122:80
54.37.42.48:8080
91.121.54.71:8080
83.169.21.32:7080
68.69.155.181:80
67.247.242.247:80
213.197.182.158:8080
45.173.88.33:80
111.67.12.221:8080
217.13.106.14:8080
191.99.160.58:80
178.148.55.236:8080
85.109.159.61:443
110.142.219.51:80
50.28.51.143:8080
77.90.136.129:8080
209.236.123.42:8080
72.135.200.124:80
184.66.18.83:80
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4609c19a333114a5786ed22f4ba0694f0cd89d954661f945fdc4b71c9fe0bb47_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4609c19a333114a5786ed22f4ba0694f0cd89d954661f945fdc4b71c9fe0bb47_NeikiAnalytics.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1588-0-0x00000000003C0000-0x00000000003CC000-memory.dmpFilesize
48KB
-
memory/1588-5-0x00000000003B0000-0x00000000003B9000-memory.dmpFilesize
36KB
-
memory/1588-4-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/1588-6-0x00000000003C0000-0x00000000003CC000-memory.dmpFilesize
48KB