Analysis
- max time kernel
74s - max time network
117s - platform
windows10_x64 - resource
win10 - submitted
24/06/2020, 15:06
General
- Target aeb5918b32bf5beccd7b45c00049af6a1754d3834f3f3e1376c60f33df02c385.exe
- Size 248KB
- Sample200624-p3amc8fm6a
- SHA256 aeb5918b32bf5beccd7b45c00049af6a1754d3834f3f3e1376c60f33df02c385
Score
10/10
Malware Config
Extracted
Family
-
emotet
C2
-
81.169.202.3:443
-
91.236.4.234:443
-
192.241.143.52:8080
-
190.6.193.152:8080
-
70.32.84.74:8080
-
204.225.249.100:7080
-
72.47.248.48:7080
-
175.114.178.83:443
-
104.236.161.64:8080
-
207.255.37.143:80
-
203.25.159.3:8080
-
93.147.157.195:80
-
61.92.159.208:8080
-
221.133.46.86:443
-
192.241.146.84:8080
-
187.51.47.26:80
-
77.55.211.77:8080
-
68.183.190.199:8080
-
185.94.252.27:443
-
186.33.141.88:80
rsa_pubkey.plain
Signatures
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious behavior: EmotetMutantsSpam 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
Processes
-
C:\Users\Admin\AppData\Local\Temp\aeb5918b32bf5beccd7b45c00049af6a1754d3834f3f3e1376c60f33df02c385.exe"C:\Users\Admin\AppData\Local\Temp\aeb5918b32bf5beccd7b45c00049af6a1754d3834f3f3e1376c60f33df02c385.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\KBDTAJIK\KBDTAJIK.exe"C:\Windows\SysWOW64\KBDTAJIK\KBDTAJIK.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2548-3-0x00000000005A0000-0x00000000005AC000-memory.dmp
memory/2548-4-0x0000000000400000-0x000000000043E000-memory.dmp
memory/3700-0-0x00000000005E0000-0x00000000005EC000-memory.dmp
memory/3700-1-0x0000000000400000-0x000000000043E000-memory.dmp