Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-11-2024 18:09

General

  • Target

    b9dd35acf425d3b2dfb3fd990963bf413910331eaa843b6c34323eeea94b6278.exe

  • Size

    108KB

  • MD5

    fa8a38e20ec02f7f3ed85f09e4bf5564

  • SHA1

    b66cc668203a72897d8c26ff535baadfb84ecbe0

  • SHA256

    b9dd35acf425d3b2dfb3fd990963bf413910331eaa843b6c34323eeea94b6278

  • SHA512

    ca59f8df90c4f402fb9dd1f9819ed5da389d96914fae1ad6753519813f82aff969178faead107dfa9d35e5beaf50d1d1d15c4435f11808c5a1e50bb2dfea2308

  • SSDEEP

    1536:XbqV8t0KNUY3Di91md79R5m6Aw2d2iROp:XbqaY1UH5At05p

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

112.78.142.170:80

178.128.14.92:8080

178.238.232.46:443

185.142.236.163:443

192.210.217.94:8080

192.241.220.183:8080

105.209.235.113:8080

182.187.139.200:8080

188.0.135.237:80

201.213.177.139:80

31.146.61.34:80

202.5.47.71:80

81.17.93.134:80

192.163.221.191:8080

97.104.107.190:80

201.235.10.215:80

181.114.114.203:80

51.38.201.19:7080

46.32.229.152:8080

177.144.130.105:443

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet family
  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b9dd35acf425d3b2dfb3fd990963bf413910331eaa843b6c34323eeea94b6278.exe
    "C:\Users\Admin\AppData\Local\Temp\b9dd35acf425d3b2dfb3fd990963bf413910331eaa843b6c34323eeea94b6278.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2096

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2096-1-0x00000000002B0000-0x00000000002BC000-memory.dmp

    Filesize

    48KB

  • memory/2096-0-0x0000000000270000-0x0000000000279000-memory.dmp

    Filesize

    36KB

  • memory/2096-5-0x00000000002B0000-0x00000000002BC000-memory.dmp

    Filesize

    48KB