Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

4b64c9b3e0...a0.exe

windows7-x64

10

4b64c9b3e0...a0.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    136s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/11/2024, 22:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4b64c9b3e01f5108c4e3a19748afaaf38d1ed54e710e1d85bef4d7a9c33b22a0.exe

  • Size

    60KB

  • MD5

    9664b910391855128224b743031ae7e6

  • SHA1

    28191b02bbb6e4389e120fe1f7adfdbe6e4930a9

  • SHA256

    4b64c9b3e01f5108c4e3a19748afaaf38d1ed54e710e1d85bef4d7a9c33b22a0

  • SHA512

    847ed76a5218337d88d235a1760726b443cd9014b4f4054d4fdd4ae903e930dcb2e4bd17ea55206f042b8dea1f88c9691afd452d0a94235ffce2356f44ab6932

  • SSDEEP

    768:LTEgbXnp5TK0LR8n4oWPjpbf5fHWF43z0f4Gu4hX4JjRI0ny6Rq/Ab2a5iuLK0Od:60LOjApXzBaXAjmd1aMuLi/cPyXlC

Score
10/10
emotetepoch3bankerdiscoverytrojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

92.24.51.238:80

139.99.157.213:8080

188.166.25.84:8080

81.214.253.80:443

5.79.70.250:8080

41.185.29.128:8080

181.164.110.7:80

177.37.81.212:443

203.153.216.178:7080

178.33.167.120:8080

77.74.78.80:443

37.70.131.107:80

190.164.75.175:80

75.127.14.170:8080

78.188.170.128:80

113.161.148.81:80

105.209.235.113:8080

177.144.130.105:443

81.17.93.134:80

181.134.9.162:80
rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Emotet family
    emotet
  • Emotet payload 3 IoCs

    Detects Emotet payload in memory.

    trojanbanker
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4b64c9b3e01f5108c4e3a19748afaaf38d1ed54e710e1d85bef4d7a9c33b22a0.exe
    "C:\Users\Admin\AppData\Local\Temp\4b64c9b3e01f5108c4e3a19748afaaf38d1ed54e710e1d85bef4d7a9c33b22a0.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2428

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2428-0-0x0000000002260000-0x000000000226C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2428-1-0x0000000002250000-0x0000000002259000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2428-5-0x0000000002260000-0x000000000226C000-memory.dmp

    Filesize

    48KB

    Download