Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07-02-2025 18:26
General
-
Target
2025-02-07_0d693fa6577930f3effe9415ed240a39_icedid.exe
-
Size
184KB
-
MD5
0d693fa6577930f3effe9415ed240a39
-
SHA1
7e7eb075fe16de13a8f2b8416bce39682675fa8c
-
SHA256
fdbd847b84823380d85b7de1296fb1f93f26348c511abba206b2eef152a2567b
-
SHA512
805434b1e301bc2ba09f72bc4424b242f769e3ad230fab2400ef85e0df04463390d3d2ae195e701ab33c16c8274f08bd21415f18ab984685c9699e0192bfb038
-
SSDEEP
3072:gY35A8AJo3yvG6mnXIyehsCglKxWW6EzlN8yqH7KtF+fQeKRZMWYEomzFsH:r5ADJcyvGZXTAsVKUvET8vKtF+fQvcWc
Malware Config
Extracted
emotet
Epoch1
174.118.202.24:443
192.232.229.54:7080
46.101.58.37:8080
37.187.161.206:8080
12.163.208.58:80
177.74.228.34:80
68.183.190.199:8080
212.71.237.140:8080
94.176.234.118:443
185.94.252.12:80
51.15.7.189:80
190.24.243.186:80
186.70.127.199:8090
60.93.23.51:80
149.202.72.142:7080
5.196.35.138:7080
45.33.77.42:8080
85.214.26.7:8080
83.169.21.32:7080
111.67.12.221:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet family
-
Emotet payload 3 IoCs
Detects Emotet payload in memory.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-02-07_0d693fa6577930f3effe9415ed240a39_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2025-02-07_0d693fa6577930f3effe9415ed240a39_icedid.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
-
Filesize
60KB
-
Filesize
64KB