82690874bd3b94f1aa345668c5333c8eb231721304ad6143179026b593c018f1 | Triage

Analysis

max time kernel
32s
max time network
38s
resource
win7

Sharing

General

Target

82690874bd3b94f1aa345668c5333c8eb231721304ad6143179026b593c018f1
Sample

191001-jp6wg36eee
SHA256

82690874bd3b94f1aa345668c5333c8eb231721304ad6143179026b593c018f1

Score

N/A

Malware Config

Signatures

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory 2 IoCs

at	description	Process	procid_target
1139	PID 1228 wrote to memory of 1480	82690874bd3b94f1aa345668c5333c8eb231721304ad6143179026b593c018f1.exe	25
6428	PID 1540 wrote to memory of 1096	loadarouter.exe	27

Emotet Mutex I 2 IoCs

description	ioc	Process
Mutant created	Global\I64C019BB	82690874bd3b94f1aa345668c5333c8eb231721304ad6143179026b593c018f1.exe
Mutant created	Global\I64C019BB	loadarouter.exe

Emotet Mutex II 2 IoCs

description	ioc	Process
Mutant created	Global\M64C019BB	82690874bd3b94f1aa345668c5333c8eb231721304ad6143179026b593c018f1.exe
Mutant created	Global\M64C019BB	loadarouter.exe

Drops file in system dir 7 IoCs

at	description	ioc	Process
6038	File renamed	C:\Users\Admin\AppData\Local\Temp\82690874bd3b94f1aa345668c5333c8eb231721304ad6143179026b593c018f1.exe => C:\Windows\SysWOW64\loadarouter.exe	82690874bd3b94f1aa345668c5333c8eb231721304ad6143179026b593c018f1.exe
28034	File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	loadarouter.exe
32339	File created (read-only)	C:\Windows\TEMP\E8F7.tmp	loadarouter.exe
32339	File deleted	C:\Windows\Temp\E8F7.tmp	loadarouter.exe
32339	File created	C:\Windows\SysWOW64\loadarouterb.exe	loadarouter.exe
32339	File opened for modification	C:\Windows\SysWOW64\loadarouterb.exe	loadarouter.exe
32370	File deleted	C:\Windows\SysWOW64\loadarouterb.exe	loadarouter.exe

Suspicious behavior: RenamesItself
Suspicious behavior: EnumeratesProcesses
emotet family
family

C:\Users\Admin\AppData\Local\Temp\82690874bd3b94f1aa345668c5333c8eb231721304ad6143179026b593c018f1.exe
"C:\Users\Admin\AppData\Local\Temp\82690874bd3b94f1aa345668c5333c8eb231721304ad6143179026b593c018f1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1228

C:\Users\Admin\AppData\Local\Temp\82690874bd3b94f1aa345668c5333c8eb231721304ad6143179026b593c018f1.exe
--794fc4a9
1⤵
- Emotet Mutex I
- Emotet Mutex II
- Drops file in system dir
PID:1480

C:\Windows\SysWOW64\loadarouter.exe
"C:\Windows\SysWOW64\loadarouter.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\SysWOW64\loadarouter.exe
--f7a216da
1⤵
- Emotet Mutex I
- Emotet Mutex II
- Drops file in system dir
PID:1096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads