Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-11-2024 17:45

General

  • Target

    4f9e4fa7f372ba5b423a74c3e25ad326f1e624f90606f9981dc066e9fbdc628b.exe

  • Size

    688KB

  • MD5

    4cdf166911b191742d3d61b05e4dc340

  • SHA1

    fa62530e26f6b641f48f600f6c1bbf2e1b93d7c3

  • SHA256

    4f9e4fa7f372ba5b423a74c3e25ad326f1e624f90606f9981dc066e9fbdc628b

  • SHA512

    e09e22c2bedfaea4cce5d46a8d05343503dda4dc5f761b9c875e1c9c03aae34ca8e8f8bd7fa7ed7cef8af177452402bedb97a29264ff67cb8439a1e110e4c1ab

  • SSDEEP

    12288:NXz2U60rdzO9aD+viCT+RMGetwifr4whf3t70O/y:ZOFviClGet8SAO/y

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

47.146.32.175:80

212.51.142.238:8080

200.55.243.138:8080

65.111.120.223:80

47.144.21.12:443

81.2.235.111:8080

152.168.248.128:443

24.43.99.75:80

114.146.222.200:80

50.116.86.205:8080

121.124.124.40:7080

153.126.210.205:7080

183.101.175.193:80

189.212.199.126:443

62.75.141.82:80

46.105.131.79:8080

104.236.246.93:8080

83.110.223.58:443

162.241.92.219:8080

180.92.239.110:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet family
  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f9e4fa7f372ba5b423a74c3e25ad326f1e624f90606f9981dc066e9fbdc628b.exe
    "C:\Users\Admin\AppData\Local\Temp\4f9e4fa7f372ba5b423a74c3e25ad326f1e624f90606f9981dc066e9fbdc628b.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2168

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2168-4-0x0000000000260000-0x0000000000269000-memory.dmp

    Filesize

    36KB

  • memory/2168-1-0x0000000000280000-0x000000000028C000-memory.dmp

    Filesize

    48KB

  • memory/2168-5-0x0000000000280000-0x000000000028C000-memory.dmp

    Filesize

    48KB