Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/11/2024, 21:40

General

  • Target

    332c14cd675ae25fa50d126067d2528a296c795b7000a10237b656b288c011b9.exe

  • Size

    336KB

  • MD5

    5be465a6e7a9c5f33f59d593a556cc08

  • SHA1

    ab0526e0068cee85e6d6a5c1e593ae65d4537997

  • SHA256

    332c14cd675ae25fa50d126067d2528a296c795b7000a10237b656b288c011b9

  • SHA512

    d8dea075303c1a67c4db224341cf3361b70ab1f7e33cb38205a27a13de82bf575ce6f09067ee80ee2348e9587dedae297629ada18143a94fb84038ce0d12b29c

  • SSDEEP

    6144:Sr7hkh2eL5b+ZTTTBx+Dqn9iin9dgn9BvirtTokDqHEPIzE/:SnGL8TTTBx+Dqn9iin9dgn9Bvifqkp

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

24.230.141.169:80

72.249.144.95:8080

164.160.45.41:8080

120.150.218.241:443

118.83.154.64:443

61.33.119.226:443

66.76.12.94:8080

46.105.131.79:8080

83.110.223.58:443

185.94.252.104:443

75.143.247.51:80

130.0.132.242:80

203.153.216.189:7080

139.162.60.124:8080

176.111.60.55:8080

194.4.58.192:7080

134.209.36.254:8080

110.145.77.103:80

142.112.10.95:20

79.98.24.39:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet family
  • Emotet payload 2 IoCs

    Detects Emotet payload in memory.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\332c14cd675ae25fa50d126067d2528a296c795b7000a10237b656b288c011b9.exe
    "C:\Users\Admin\AppData\Local\Temp\332c14cd675ae25fa50d126067d2528a296c795b7000a10237b656b288c011b9.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2360

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2360-15-0x0000000002380000-0x0000000002382000-memory.dmp

          Filesize

          8KB

        • memory/2360-14-0x0000000002380000-0x0000000002382000-memory.dmp

          Filesize

          8KB

        • memory/2360-16-0x0000000000422000-0x0000000000423000-memory.dmp

          Filesize

          4KB

        • memory/2360-21-0x0000000000400000-0x0000000000456000-memory.dmp

          Filesize

          344KB

        • memory/2360-17-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

          Filesize

          64KB

        • memory/2360-13-0x0000000002380000-0x0000000002382000-memory.dmp

          Filesize

          8KB

        • memory/2360-12-0x0000000002380000-0x0000000002382000-memory.dmp

          Filesize

          8KB

        • memory/2360-11-0x0000000002380000-0x0000000002382000-memory.dmp

          Filesize

          8KB

        • memory/2360-10-0x0000000002380000-0x0000000002382000-memory.dmp

          Filesize

          8KB

        • memory/2360-9-0x0000000002380000-0x0000000002382000-memory.dmp

          Filesize

          8KB

        • memory/2360-8-0x0000000002380000-0x0000000002382000-memory.dmp

          Filesize

          8KB

        • memory/2360-7-0x0000000002380000-0x0000000002382000-memory.dmp

          Filesize

          8KB

        • memory/2360-6-0x0000000002380000-0x0000000002382000-memory.dmp

          Filesize

          8KB

        • memory/2360-3-0x0000000002380000-0x0000000002382000-memory.dmp

          Filesize

          8KB

        • memory/2360-4-0x0000000002380000-0x0000000002382000-memory.dmp

          Filesize

          8KB

        • memory/2360-5-0x0000000002380000-0x0000000002382000-memory.dmp

          Filesize

          8KB

        • memory/2360-22-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

          Filesize

          64KB