Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-11-2024 17:31

General

  • Target

    cd4826a4e2479bbc59163bf37a9f09c3c5eadcf2a9068bf538b84ff6e9ba5d57.exe

  • Size

    550KB

  • MD5

    3f081af9c01e4e6b96a1fe53f6ca16b3

  • SHA1

    4cbe8e038b479f2215f589c1528d9ca0b1a7032d

  • SHA256

    cd4826a4e2479bbc59163bf37a9f09c3c5eadcf2a9068bf538b84ff6e9ba5d57

  • SHA512

    2b8f3596c7e35d083c00382d3ba66b24f4624408be356367d808dfe62e0d8e0ca12079899391feb8c0349195551e15ad4205b1dbd256b64f164b4fbde52644b0

  • SSDEEP

    12288:F3MzbACOHXbGSZmpT7tUt/t1tJtE6eb2B2aDj:FOsCOHzmpTUrBBn

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

179.15.102.2:80

91.121.200.35:8080

159.203.16.11:8080

188.226.165.170:8080

78.90.78.210:80

181.59.59.54:80

143.95.101.72:8080

61.118.67.173:80

113.203.238.130:80

109.99.146.210:8080

2.58.16.86:8080

50.116.78.109:8080

188.166.220.180:7080

175.103.38.146:80

198.20.228.9:8080

5.2.246.108:80

115.79.195.246:80

187.193.221.143:80

41.76.213.144:8080

180.148.4.130:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet family
  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cd4826a4e2479bbc59163bf37a9f09c3c5eadcf2a9068bf538b84ff6e9ba5d57.exe
    "C:\Users\Admin\AppData\Local\Temp\cd4826a4e2479bbc59163bf37a9f09c3c5eadcf2a9068bf538b84ff6e9ba5d57.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2168

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2168-6-0x0000000001F00000-0x0000000001F32000-memory.dmp

    Filesize

    200KB

  • memory/2168-5-0x00000000004E0000-0x0000000000511000-memory.dmp

    Filesize

    196KB

  • memory/2168-1-0x0000000000590000-0x00000000005C3000-memory.dmp

    Filesize

    204KB