Analysis

  • max time kernel
    104s
  • resource
    win10v191014
  • submitted
    27-01-2020 21:13

General

  • Target

    da9fe0fe3462c70c6913796b9bd7948dcebec4c9c78ebb7624bd78ad3f15f169

  • Sample

    200127-1wrdsj99wa

  • SHA256

    da9fe0fe3462c70c6913796b9bd7948dcebec4c9c78ebb7624bd78ad3f15f169

Score
10/10

Malware Config

Extracted

Family

emotet

C2

195.250.143.182:80

184.162.115.11:443

70.60.238.62:80

68.183.18.169:8080

178.62.75.204:8080

178.33.167.120:8080

144.76.56.36:8080

216.75.37.196:8080

78.189.165.52:8080

185.192.75.240:443

202.229.211.95:80

190.5.162.204:80

24.141.12.228:80

41.185.29.128:8080

192.210.217.94:8080

110.2.118.164:80

203.153.216.178:7080

37.70.131.107:80

75.86.6.174:80

122.176.116.57:443

rsa_pubkey.plain

Signatures

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails

  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Suspicious behavior: EmotetMutantsSpam 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\da9fe0fe3462c70c6913796b9bd7948dcebec4c9c78ebb7624bd78ad3f15f169.exe
    "C:\Users\Admin\AppData\Local\Temp\da9fe0fe3462c70c6913796b9bd7948dcebec4c9c78ebb7624bd78ad3f15f169.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4924
    • C:\Users\Admin\AppData\Local\Temp\da9fe0fe3462c70c6913796b9bd7948dcebec4c9c78ebb7624bd78ad3f15f169.exe
      --d83ca08b
      2⤵
      • Suspicious behavior: RenamesItself
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious behavior: EmotetMutantsSpam
      PID:4956
  • C:\Windows\SysWOW64\sidebarcreatea.exe
    "C:\Windows\SysWOW64\sidebarcreatea.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4276
    • C:\Windows\SysWOW64\sidebarcreatea.exe
      --cf8e243b
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious behavior: EmotetMutantsSpam
      PID:1784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1784-4-0x00000000005D0000-0x00000000005E7000-memory.dmp
    Filesize

    92KB

  • memory/1784-5-0x0000000000400000-0x000000000045C000-memory.dmp
    Filesize

    368KB

  • memory/4276-3-0x0000000000E40000-0x0000000000E57000-memory.dmp
    Filesize

    92KB

  • memory/4924-0-0x0000000000640000-0x0000000000657000-memory.dmp
    Filesize

    92KB

  • memory/4956-1-0x0000000000500000-0x0000000000517000-memory.dmp
    Filesize

    92KB

  • memory/4956-2-0x0000000000400000-0x000000000045C000-memory.dmp
    Filesize

    368KB