Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
21/05/2024, 12:02
General
- Target 4609c19a333114a5786ed22f4ba0694f0cd89d954661f945fdc4b71c9fe0bb47_NeikiAnalytics.exe
- Size 156KB
- Sample240521-n7pywsda2z
- SHA256 4609c19a333114a5786ed22f4ba0694f0cd89d954661f945fdc4b71c9fe0bb47
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch1
C2
-
50.121.220.50:80
-
51.75.33.122:80
-
54.37.42.48:8080
-
91.121.54.71:8080
-
83.169.21.32:7080
-
68.69.155.181:80
-
67.247.242.247:80
-
213.197.182.158:8080
-
45.173.88.33:80
-
111.67.12.221:8080
-
217.13.106.14:8080
-
191.99.160.58:80
-
178.148.55.236:8080
-
85.109.159.61:443
-
110.142.219.51:80
-
50.28.51.143:8080
-
77.90.136.129:8080
-
209.236.123.42:8080
-
72.135.200.124:80
-
184.66.18.83:80
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4609c19a333114a5786ed22f4ba0694f0cd89d954661f945fdc4b71c9fe0bb47_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4609c19a333114a5786ed22f4ba0694f0cd89d954661f945fdc4b71c9fe0bb47_NeikiAnalytics.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2676-5-0x0000000000AC0000-0x0000000000AC9000-memory.dmp
memory/2676-4-0x0000000000A70000-0x0000000000A71000-memory.dmp
memory/2676-0-0x0000000000AD0000-0x0000000000ADC000-memory.dmp
memory/2676-6-0x0000000000AD0000-0x0000000000ADC000-memory.dmp