Analysis

  • max time kernel
    129s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-11-2024 17:33

General

  • Target

    559d159e421a52c7023e8da4eb50cbdbecf4797adb32e24d7ca6d36a27f48621.exe

  • Size

    618KB

  • MD5

    2a1af2c5c7ddf6218d4ca958a1efdff3

  • SHA1

    d3ba84a46322536d955b3266a966c0f3572d587b

  • SHA256

    559d159e421a52c7023e8da4eb50cbdbecf4797adb32e24d7ca6d36a27f48621

  • SHA512

    681a7d536f5bbc48fd3f0382726a619602cbbc7929255b94154da0326254f5639b9d536baf4d1e1d5ae02f2de76a5eb4e6bd5ac0895b730c4f7902b23c516955

  • SSDEEP

    12288:tkDwmoShmmptEPCZG1UrIujTQSk+wn0Y4GBinko/4GCGKyZDE93AbWxPPywg:tWnhDpLGOrZjT/USING5E93AbW1+

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

200.59.6.174:80

59.148.253.194:8080

173.212.197.71:8080

98.103.204.12:443

192.232.229.54:7080

185.94.252.12:80

74.135.120.91:80

5.189.178.202:8080

202.134.4.210:7080

181.129.96.162:8080

70.32.84.74:8080

190.190.219.184:80

178.250.54.208:8080

94.176.234.118:443

76.121.199.225:80

191.97.154.2:80

46.101.58.37:8080

103.236.179.162:80

217.13.106.14:8080

82.76.111.249:443

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet family
  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\559d159e421a52c7023e8da4eb50cbdbecf4797adb32e24d7ca6d36a27f48621.exe
    "C:\Users\Admin\AppData\Local\Temp\559d159e421a52c7023e8da4eb50cbdbecf4797adb32e24d7ca6d36a27f48621.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2420

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2420-0-0x0000000001EF0000-0x0000000001F4A000-memory.dmp

    Filesize

    360KB

  • memory/2420-8-0x00000000004B0000-0x0000000000508000-memory.dmp

    Filesize

    352KB

  • memory/2420-4-0x0000000001F50000-0x0000000001FA9000-memory.dmp

    Filesize

    356KB