Analysis
- max time kernel
147s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
13/11/2024, 17:51
General
- Target f716a6f13daf2fac59fe39942abed277bcce33fb7dd42997c459c374837f8104.exe
- Size 356KB
- Sample241113-we6pyawfra
- SHA256 f716a6f13daf2fac59fe39942abed277bcce33fb7dd42997c459c374837f8104
Malware Config
Extracted
-
emotet
-
Epoch2
-
102.182.145.130:80
-
173.173.254.105:80
-
64.207.182.168:8080
-
51.89.199.141:8080
-
167.114.153.111:8080
-
173.63.222.65:80
-
218.147.193.146:80
-
59.125.219.109:443
-
172.104.97.173:8080
-
190.162.215.233:80
-
68.115.186.26:80
-
78.188.106.53:443
-
190.240.194.77:443
-
24.133.106.23:80
-
80.227.52.78:80
-
79.137.83.50:443
-
120.150.218.241:443
-
62.171.142.179:8080
-
194.4.58.192:7080
-
62.30.7.67:443
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Emotet family
- Emotet payload 3 IoCs
Detects Emotet payload in memory.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f716a6f13daf2fac59fe39942abed277bcce33fb7dd42997c459c374837f8104.exe"C:\Users\Admin\AppData\Local\Temp\f716a6f13daf2fac59fe39942abed277bcce33fb7dd42997c459c374837f8104.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1100-6-0x0000000002AA0000-0x0000000002AD3000-memory.dmp
memory/1100-2-0x0000000002A20000-0x0000000002A51000-memory.dmp
memory/1100-1-0x0000000002A60000-0x0000000002A94000-memory.dmp