Analysis

  • max time kernel
    130s
  • max time network
    149s
  • resource
    win10v191014

General

  • Target

    9272b10a338140158ea856a53c658dc704be76579ec8f13ff27b4349ad7d03d2

  • Sample

    191120-9ane93lles

  • SHA256

    9272b10a338140158ea856a53c658dc704be76579ec8f13ff27b4349ad7d03d2

Score
N/A

Malware Config

Extracted

Family

emotet

C2

198.58.120.26:8080

209.97.168.52:8080

37.187.2.199:443

149.202.197.94:8080

190.147.215.53:22

115.78.95.230:443

87.106.136.232:8080

186.4.172.5:8080

190.145.67.134:8090

83.136.245.190:8080

191.92.209.110:7080

190.211.207.11:443

5.196.74.210:8080

85.104.59.244:20

78.24.219.147:8080

190.53.135.159:21

211.63.71.72:8080

212.129.24.79:8080

165.227.156.155:443

182.176.132.213:8090

rsa_pubkey.plain

Signatures

  • Suspicious behavior: RenamesItself 1 IoCs
  • Checks system information in the registry (likely anti-VM) 2 TTPs 2 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Emotet Sync 1 IoCs
  • Suspicious behavior: EmotetMutantsSpam 2 IoCs
  • Drops file in system dir 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • emotet family

Processes

  • C:\Users\Admin\AppData\Local\Temp\9272b10a338140158ea856a53c658dc704be76579ec8f13ff27b4349ad7d03d2.exe
    "C:\Users\Admin\AppData\Local\Temp\9272b10a338140158ea856a53c658dc704be76579ec8f13ff27b4349ad7d03d2.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4872
  • C:\Users\Admin\AppData\Local\Temp\9272b10a338140158ea856a53c658dc704be76579ec8f13ff27b4349ad7d03d2.exe
    --40556ffc
    1⤵
    • Suspicious behavior: RenamesItself
    • Emotet Sync
    • Suspicious behavior: EmotetMutantsSpam
    • Drops file in system dir
    PID:4912
  • C:\Windows\system32\SppExtComObj.exe
    C:\Windows\system32\SppExtComObj.exe -Embedding
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4976
  • C:\Windows\System32\SLUI.exe
    "C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
    1⤵
      PID:5004
    • C:\Windows\SysWOW64\rawattrib.exe
      "C:\Windows\SysWOW64\rawattrib.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:8
    • C:\Windows\SysWOW64\rawattrib.exe
      --9e8f6508
      1⤵
      • Suspicious behavior: EmotetMutantsSpam
      • Drops file in system dir
      • Suspicious behavior: EnumeratesProcesses
      PID:380
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s BITS
      1⤵
      • Drops file in system dir
      PID:2952
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
      1⤵
        PID:4480
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s DoSvc
        1⤵
        • Checks system information in the registry (likely anti-VM)
        PID:4176
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
        1⤵
        • Windows security modification
        PID:3968
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k unistacksvcgroup
        1⤵
          PID:2056

        Network

        MITRE ATT&CK Enterprise v15

        MITRE ATT&CK Additional techniques

        • T1089

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\403f0cc78adafaecdb503a6c6424923d_293fa5bd-edfb-4bba-800e-a7dce3ea3438

        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-634046074-2673730973-2644684987-1000\0f5007522459c86e95ffcc62f32308f1_293fa5bd-edfb-4bba-800e-a7dce3ea3438

        • memory/8-4-0x0000000000C80000-0x0000000000C95000-memory.dmp

          Filesize

          84KB

        • memory/380-6-0x00000000006B0000-0x00000000006C5000-memory.dmp

          Filesize

          84KB

        • memory/380-7-0x0000000000400000-0x000000000046C000-memory.dmp

          Filesize

          432KB

        • memory/4872-0-0x00000000006D0000-0x00000000006E5000-memory.dmp

          Filesize

          84KB

        • memory/4912-2-0x00000000006C0000-0x00000000006D5000-memory.dmp

          Filesize

          84KB

        • memory/4912-3-0x0000000000400000-0x000000000046C000-memory.dmp

          Filesize

          432KB