Analysis

  • max time kernel
    134s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 17:33

General

  • Target

    559d159e421a52c7023e8da4eb50cbdbecf4797adb32e24d7ca6d36a27f48621.exe

  • Size

    618KB

  • MD5

    2a1af2c5c7ddf6218d4ca958a1efdff3

  • SHA1

    d3ba84a46322536d955b3266a966c0f3572d587b

  • SHA256

    559d159e421a52c7023e8da4eb50cbdbecf4797adb32e24d7ca6d36a27f48621

  • SHA512

    681a7d536f5bbc48fd3f0382726a619602cbbc7929255b94154da0326254f5639b9d536baf4d1e1d5ae02f2de76a5eb4e6bd5ac0895b730c4f7902b23c516955

  • SSDEEP

    12288:tkDwmoShmmptEPCZG1UrIujTQSk+wn0Y4GBinko/4GCGKyZDE93AbWxPPywg:tWnhDpLGOrZjT/USING5E93AbW1+

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

200.59.6.174:80

59.148.253.194:8080

173.212.197.71:8080

98.103.204.12:443

192.232.229.54:7080

185.94.252.12:80

74.135.120.91:80

5.189.178.202:8080

202.134.4.210:7080

181.129.96.162:8080

70.32.84.74:8080

190.190.219.184:80

178.250.54.208:8080

94.176.234.118:443

76.121.199.225:80

191.97.154.2:80

46.101.58.37:8080

103.236.179.162:80

217.13.106.14:8080

82.76.111.249:443

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet family
  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\559d159e421a52c7023e8da4eb50cbdbecf4797adb32e24d7ca6d36a27f48621.exe
    "C:\Users\Admin\AppData\Local\Temp\559d159e421a52c7023e8da4eb50cbdbecf4797adb32e24d7ca6d36a27f48621.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4564

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4564-0-0x0000000002330000-0x000000000238A000-memory.dmp

    Filesize

    360KB

  • memory/4564-5-0x00000000023C0000-0x0000000002419000-memory.dmp

    Filesize

    356KB

  • memory/4564-4-0x00000000022D0000-0x0000000002328000-memory.dmp

    Filesize

    352KB