Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 01:01
Static task
static1
Behavioral task
behavioral1
Sample
2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe
Resource
win7-20240903-en
General
-
Target
2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe
-
Size
385KB
-
MD5
09158f830469b8929e57ed050e6f73a7
-
SHA1
d20d076fdbadf851d974518db4669af69b54a328
-
SHA256
4126b57691a639ca3bd94574db8ac88766d3245f4cb9d26bab306f4b5a105b92
-
SHA512
17ce00de5a1fda2e670126bab3bb48044687d3a7b0ea8795a2f52fe97dee1bd2c6e16b627667ae0bcb75f28baf0ab4499844cb6dd50a0b02fb8f3b3e919b8325
-
SSDEEP
6144:153sLlAuORXSAMyd6DssOEl5/zxnt/QJWn+KXKwTCvNjHzETSURHQBNoo:fMMSAv3El5bxVQJWn/XKaCpKfIX
Malware Config
Extracted
emotet
Epoch1
201.171.150.41:443
94.76.247.61:8080
213.176.36.147:8080
190.181.235.46:80
181.36.42.205:443
83.169.21.32:7080
24.148.98.177:80
188.2.217.94:80
82.196.15.205:8080
145.236.8.174:80
73.116.193.136:80
178.79.163.131:8080
189.2.177.210:443
202.62.39.111:80
177.74.228.34:80
94.176.234.118:443
181.129.96.162:8080
186.103.141.250:443
191.99.160.58:80
111.67.12.221:8080
190.147.137.153:443
104.131.103.37:8080
68.183.170.114:8080
89.32.150.160:8080
51.159.23.217:443
58.171.153.81:80
94.206.45.18:80
190.6.193.152:8080
147.91.184.91:80
172.104.169.32:8080
181.120.79.227:80
46.28.111.142:7080
186.250.52.226:8080
190.190.148.27:8080
191.182.6.118:80
192.241.143.52:8080
114.109.179.60:80
91.219.169.180:80
12.162.84.2:8080
192.187.99.90:8080
77.90.136.129:8080
178.250.54.208:8080
219.92.13.25:80
68.183.190.199:8080
177.144.135.2:80
70.32.115.157:8080
186.70.127.199:8090
189.194.58.119:80
51.255.165.160:8080
80.249.176.206:80
104.131.41.185:8080
192.241.146.84:8080
5.196.35.138:7080
61.92.159.208:8080
212.231.60.98:80
82.76.111.249:443
170.81.48.2:80
81.198.69.61:80
95.85.151.205:80
212.71.237.140:8080
95.9.180.128:80
185.94.252.12:80
72.47.248.48:7080
45.161.242.102:80
213.60.96.117:80
177.66.190.130:80
201.213.156.176:80
70.32.84.74:8080
87.106.46.107:8080
217.199.160.224:7080
77.55.211.77:8080
217.13.106.14:8080
209.236.123.42:8080
185.94.252.27:443
190.115.18.139:8080
149.62.173.247:8080
104.131.103.128:443
50.28.51.143:8080
204.225.249.100:7080
190.163.31.26:80
2.47.112.152:80
177.72.13.80:80
143.0.87.101:80
137.74.106.111:7080
116.125.120.88:443
45.33.77.42:8080
187.162.248.237:80
186.32.90.103:443
177.73.0.98:443
Signatures
-
Emotet family
-
resource yara_rule behavioral2/memory/3140-0-0x00000000023D0000-0x00000000023D9000-memory.dmp emotet behavioral2/memory/3140-1-0x00000000023E0000-0x00000000023EC000-memory.dmp emotet behavioral2/memory/3140-5-0x00000000023E0000-0x00000000023EC000-memory.dmp emotet -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 3140 2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe 3140 2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe 3140 2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe 3140 2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe 3140 2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe 3140 2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe 3140 2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe 3140 2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe 3140 2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe 3140 2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe 3140 2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe 3140 2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe 3140 2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe 3140 2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe 3140 2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe 3140 2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe 3140 2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe 3140 2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3140 2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe 3140 2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3140
Network
-
Remote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request67.31.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request197.87.175.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request146.240.18.2.in-addr.arpaIN PTRResponse146.240.18.2.in-addr.arpaIN PTRa2-18-240-146deploystaticakamaitechnologiescom
-
POSThttp://213.176.36.147:8080/5Moq/RImpH/VzJ8TLZ/2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exeRemote address:213.176.36.147:8080RequestPOST /5Moq/RImpH/VzJ8TLZ/ HTTP/1.1
Referer: http://213.176.36.147/5Moq/RImpH/VzJ8TLZ/
Content-Type: multipart/form-data; boundary=---------------------------475956278648232
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: 213.176.36.147:8080
Content-Length: 4548
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 400 Bad Request
Date: Sun, 24 Nov 2024 01:02:02 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Set-Cookie: waf_404=c413fdfe-7e36-45a9-b753-10daeb636f98; Max-Age=300; Path=/; HttpOnly
Cache-Control: no-cache, no-store
x-frame-options: sameorigin
-
Remote address:8.8.8.8:53Request147.36.176.213.in-addr.arpaIN PTRResponse
-
POSThttp://190.181.235.46/l85TuztFkGpwtJtUeH/cOHXf6r8V8mZe/CGun9C5tIE/n4Em1MC5/MeMQPo6fzareNCKYoI/2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exeRemote address:190.181.235.46:80RequestPOST /l85TuztFkGpwtJtUeH/cOHXf6r8V8mZe/CGun9C5tIE/n4Em1MC5/MeMQPo6fzareNCKYoI/ HTTP/1.1
Referer: http://190.181.235.46/l85TuztFkGpwtJtUeH/cOHXf6r8V8mZe/CGun9C5tIE/n4Em1MC5/MeMQPo6fzareNCKYoI/
Content-Type: multipart/form-data; boundary=---------------------------893997114063689
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: 190.181.235.46
Content-Length: 4548
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 404 Not Found
Server: Webs
X-Frame-Options: SAMEORIGIN
Cache-Control: no-cache
Content-Length: 166
Content-Type: text/html
Connection: keep-alive
Keep-Alive: timeout=60, max=99
-
Remote address:8.8.8.8:53Request46.235.181.190.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request43.229.111.52.in-addr.arpaIN PTRResponse
-
260 B 5
-
260 B 5
-
213.176.36.147:8080http://213.176.36.147:8080/5Moq/RImpH/VzJ8TLZ/http2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe5.4kB 772 B 10 9
HTTP Request
POST http://213.176.36.147:8080/5Moq/RImpH/VzJ8TLZ/HTTP Response
400 -
190.181.235.46:80http://190.181.235.46/l85TuztFkGpwtJtUeH/cOHXf6r8V8mZe/CGun9C5tIE/n4Em1MC5/MeMQPo6fzareNCKYoI/http2024-11-24_09158f830469b8929e57ed050e6f73a7_icedid.exe5.5kB 731 B 9 8
HTTP Request
POST http://190.181.235.46/l85TuztFkGpwtJtUeH/cOHXf6r8V8mZe/CGun9C5tIE/n4Em1MC5/MeMQPo6fzareNCKYoI/HTTP Response
404 -
260 B 5
-
260 B 5
-
260 B 5
-
208 B 4
-
73 B 159 B 1 1
DNS Request
228.249.119.40.in-addr.arpa
-
146 B 144 B 2 1
DNS Request
240.221.184.93.in-addr.arpa
DNS Request
240.221.184.93.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
67.31.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
197.87.175.4.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
15.164.165.52.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
146.240.18.2.in-addr.arpa
-
73 B 133 B 1 1
DNS Request
147.36.176.213.in-addr.arpa
-
73 B 133 B 1 1
DNS Request
46.235.181.190.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
43.229.111.52.in-addr.arpa