Analysis
- max time kernel
132s - max time network
159s - platform
windows7_x64 - resource
win7v200430 - submitted
29/06/2020, 07:28
General
- Target 349142d1b5ebc4eb67db6346778999c8a0cf6cb077ef02b910219037a72e38cc.exe
- Size 346KB
- Sample200629-d7c3rdqabs
- SHA256 349142d1b5ebc4eb67db6346778999c8a0cf6cb077ef02b910219037a72e38cc
Score
10/10
Malware Config
Extracted
Family
-
emotet
C2
-
80.249.176.206:80
-
91.236.4.234:443
-
70.32.84.74:8080
-
149.62.173.247:8080
-
212.71.237.140:8080
-
45.161.242.102:80
-
170.81.48.2:80
-
72.47.248.48:7080
-
81.169.202.3:443
-
190.163.1.31:8080
-
12.162.84.2:8080
-
77.55.211.77:8080
-
181.31.211.181:80
-
91.83.93.124:7080
-
221.133.46.86:443
-
68.183.190.199:8080
-
186.3.232.68:80
-
190.229.148.144:80
-
177.72.13.80:80
-
185.94.252.27:443
rsa_pubkey.plain
Signatures
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious behavior: EmotetMutantsSpam 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
Processes
-
C:\Users\Admin\AppData\Local\Temp\349142d1b5ebc4eb67db6346778999c8a0cf6cb077ef02b910219037a72e38cc.exe"C:\Users\Admin\AppData\Local\Temp\349142d1b5ebc4eb67db6346778999c8a0cf6cb077ef02b910219037a72e38cc.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tdh\tdh.exe"C:\Windows\SysWOW64\tdh\tdh.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/732-0-0x0000000000240000-0x000000000024C000-memory.dmp
memory/732-1-0x0000000000400000-0x000000000045D000-memory.dmp
memory/1512-3-0x0000000000270000-0x000000000027C000-memory.dmp
memory/1512-4-0x0000000000400000-0x000000000045D000-memory.dmp