Analysis
- max time kernel
133s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
20/08/2024, 14:12
General
- Target ExeFile (305).exe
- Size 368KB
- Sample240820-rh56cswdle
- SHA256 20a674bbb373d0119df65976c7f801b1df39af13dfff74f03beea18a34649c7b
Malware Config
Extracted
-
emotet
-
Epoch1
-
177.107.79.214:8080
-
98.103.204.12:443
-
59.148.253.194:8080
-
172.86.186.21:8080
-
186.70.127.199:8090
-
201.213.177.139:80
-
177.23.7.151:80
-
12.162.84.2:8080
-
45.33.77.42:8080
-
200.59.6.174:80
-
62.84.75.50:80
-
201.49.239.200:443
-
202.134.4.210:7080
-
98.13.75.196:80
-
46.43.2.95:8080
-
177.129.17.170:443
-
152.169.22.67:80
-
138.97.60.141:7080
-
45.46.37.97:80
-
46.105.114.137:8080
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Emotet payload 3 IoCs
Detects Emotet payload in memory.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ExeFile (305).exe"C:\Users\Admin\AppData\Local\Temp\ExeFile (305).exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3412-0-0x00000000021E0000-0x0000000002203000-memory.dmp
memory/3412-8-0x00000000021C0000-0x00000000021E0000-memory.dmp
memory/3412-5-0x00000000023C0000-0x00000000023E1000-memory.dmp