Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/11/2024, 20:50

General

  • Target

    0d1d7745fa7d5a7e78ed35ff2ff23ea72f1b0ac7fc2f08f57ee896b27bb3af15.exe

  • Size

    536KB

  • MD5

    bc244e38f5ef08bedcf2f07a9913445c

  • SHA1

    f2b347ddd0c392d3073c80a26b0bf07bcc0b7d70

  • SHA256

    0d1d7745fa7d5a7e78ed35ff2ff23ea72f1b0ac7fc2f08f57ee896b27bb3af15

  • SHA512

    40449ee0e20f332bd06e74a6b4195d9a00e5da9142502a988d509578a3d55263f0a8561fb3d8baa11543650c4850da11f1cb21f94a3d4e143f79b6361b4367dc

  • SSDEEP

    3072:uLx5l6QPsGWklqY95c+Rxo7z1XUFbdZrUUsl+ixjX/phY1vnEPgg6ucUhP+2C4v6:kPfWkleyS7zxiyBvpW1PEPpXc5n4

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

94.49.254.194:80

212.51.142.238:8080

91.231.166.124:8080

162.241.92.219:8080

79.98.24.39:8080

109.117.53.230:443

78.189.165.52:8080

113.160.130.116:8443

121.124.124.40:7080

101.187.97.173:80

168.235.67.138:7080

104.131.44.150:8080

5.39.91.110:7080

139.59.60.244:8080

81.2.235.111:8080

116.203.32.252:8080

61.19.246.238:443

176.111.60.55:8080

190.55.181.54:443

108.48.41.69:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet family
  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d1d7745fa7d5a7e78ed35ff2ff23ea72f1b0ac7fc2f08f57ee896b27bb3af15.exe
    "C:\Users\Admin\AppData\Local\Temp\0d1d7745fa7d5a7e78ed35ff2ff23ea72f1b0ac7fc2f08f57ee896b27bb3af15.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1168

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1168-1-0x00000000022F0000-0x00000000022FC000-memory.dmp

          Filesize

          48KB

        • memory/1168-0-0x00000000006C0000-0x00000000006C9000-memory.dmp

          Filesize

          36KB

        • memory/1168-5-0x00000000022F0000-0x00000000022FC000-memory.dmp

          Filesize

          48KB

        • memory/1168-6-0x0000000002840000-0x0000000002931000-memory.dmp

          Filesize

          964KB