Analysis
- max time kernel
36s - max time network
119s - platform
windows7_x64 - resource
win7v200430 - submitted
06/07/2020, 07:07
General
- Target c5949decdc98c1d39c8a0d780b26ab205f6bdae073c8454ef7e5b51eb2faa93d.exe
- Size 276KB
- Sample200706-v814fdrff6
- SHA256 c5949decdc98c1d39c8a0d780b26ab205f6bdae073c8454ef7e5b51eb2faa93d
Score
10/10
Malware Config
Extracted
Family
-
emotet
C2
-
219.92.13.25:80
-
91.236.4.234:443
-
192.241.143.52:8080
-
186.3.232.68:80
-
192.241.146.84:8080
-
12.162.84.2:8080
-
50.28.51.143:8080
-
221.133.46.86:443
-
185.94.252.27:443
-
114.109.179.60:80
-
186.33.141.88:80
-
172.104.169.32:8080
-
184.57.130.8:80
-
177.139.131.143:443
-
77.55.211.77:8080
-
81.169.202.3:443
-
72.47.248.48:7080
-
212.71.237.140:8080
-
190.229.148.144:80
-
178.79.163.131:8080
rsa_pubkey.plain
Signatures
- Suspicious behavior: EmotetMutantsSpam 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5949decdc98c1d39c8a0d780b26ab205f6bdae073c8454ef7e5b51eb2faa93d.exe"C:\Users\Admin\AppData\Local\Temp\c5949decdc98c1d39c8a0d780b26ab205f6bdae073c8454ef7e5b51eb2faa93d.exe"1⤵
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\dxmasf\dxmasf.exe"C:\Windows\SysWOW64\dxmasf\dxmasf.exe"2⤵
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1028-3-0x0000000000250000-0x000000000025C000-memory.dmp
memory/1028-4-0x0000000000400000-0x0000000000449000-memory.dmp
memory/1100-0-0x0000000000240000-0x000000000024C000-memory.dmp
memory/1100-1-0x0000000000400000-0x0000000000449000-memory.dmp