Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23/02/2025, 06:27
General
-
Target
2025-02-23_6f56ad0f79d3980ef1539b461bb44472_icedid.exe
-
Size
804KB
-
MD5
6f56ad0f79d3980ef1539b461bb44472
-
SHA1
65bb13e40afb836fac24137f220f5309f41ba4af
-
SHA256
dad40e2349782238b6b37417a3500c19605ed5a225fde4c5cae38310f8755c65
-
SHA512
83dbf8f64e8a55f901f786fcd08ef5cd3d4557adacba187ac24840b565c6884420b0dd85ad176efc8867ed90d5cd90ecb575e7e18cfd1b3b067ac66235c71b0c
-
SSDEEP
12288:JVZwHUBt3AsvzmSXwShQbBVOXsnTO44BFXZzDBQ5kSLyO8SbxXt3mHX:JVeUYEz3XwS2bBVzytDBQSO8SbxXtuX
Malware Config
Extracted
emotet
Epoch2
142.105.151.124:443
95.216.118.202:8080
50.116.86.205:8080
93.51.50.171:8080
176.111.60.55:8080
169.239.182.217:8080
45.33.49.124:443
160.16.215.66:8080
201.173.217.124:443
162.154.38.103:80
186.208.123.210:443
162.241.92.219:8080
82.223.70.24:8080
23.92.16.164:8080
104.236.246.93:8080
92.222.216.44:8080
120.151.135.224:80
104.131.11.150:443
78.24.219.147:8080
62.75.187.192:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-02-23_6f56ad0f79d3980ef1539b461bb44472_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2025-02-23_6f56ad0f79d3980ef1539b461bb44472_icedid.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
-
Filesize
44KB
-
Filesize
48KB