emotet | 1ff36792edbc187f3c27fea4601240b03ebf68a35d99ee3b3aa98f27b4d04cf2

Analysis

max time kernel
131s
max time network
151s
platform
windows7_x64
resource
win7v200430
submitted
13-07-2020 08:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MsSpellCheckingFacility.bin.exe
Size

104KB
MD5

b6830b6adf76aa6b4036f7c7456713ce
SHA1

3063f03906f8823068cc4a8464b28f4c96e663d4
SHA256

1ff36792edbc187f3c27fea4601240b03ebf68a35d99ee3b3aa98f27b4d04cf2
SHA512

bf43839b157e1ba8eff983ae94ac53f14f2713f8bf0a2d38641fb941f14b7d56d25dddb09e19baa09e310ed7f780c2a374599d673c0cb57ee89eddf681310bdb

Score

10^/10

trojan banker emotet

Malware Config

Extracted

Family

emotet

181.120.79.227:80

91.236.4.234:443

190.17.195.202:80

104.131.103.37:8080

190.147.137.153:443

186.3.232.68:80

190.163.1.31:8080

143.0.87.101:80

70.32.115.157:8080

177.66.190.130:80

82.196.15.205:8080

77.90.136.129:8080

175.114.178.83:443

46.28.111.142:7080

94.176.234.118:443

114.109.179.60:80

70.32.84.74:8080

172.104.169.32:8080

113.190.254.245:80

81.169.202.3:443

rsa_pubkey.plain

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

MsSpellCheckingFacility.bin.exe

description	pid	process	target process
PID 1404 wrote to memory of 276	1404	MsSpellCheckingFacility.bin.exe	credssp.exe
PID 1404 wrote to memory of 276	1404	MsSpellCheckingFacility.bin.exe	credssp.exe
PID 1404 wrote to memory of 276	1404	MsSpellCheckingFacility.bin.exe	credssp.exe
PID 1404 wrote to memory of 276	1404	MsSpellCheckingFacility.bin.exe	credssp.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

credssp.exe

pid process

276 credssp.exe
276 credssp.exe
Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

MsSpellCheckingFacility.bin.execredssp.exe

pid process

1404 MsSpellCheckingFacility.bin.exe
1404 MsSpellCheckingFacility.bin.exe
276 credssp.exe
276 credssp.exe
Suspicious behavior: EmotetMutantsSpam 2 IoCs

Processes:

MsSpellCheckingFacility.bin.execredssp.exe

pid process

1404 MsSpellCheckingFacility.bin.exe
276 credssp.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

MsSpellCheckingFacility.bin.exe

pid process

1404 MsSpellCheckingFacility.bin.exe

pid	process
276	credssp.exe
276	credssp.exe

pid	process
1404	MsSpellCheckingFacility.bin.exe
1404	MsSpellCheckingFacility.bin.exe
276	credssp.exe
276	credssp.exe

pid	process
1404	MsSpellCheckingFacility.bin.exe
276	credssp.exe

pid	process
1404	MsSpellCheckingFacility.bin.exe

C:\Users\Admin\AppData\Local\Temp\MsSpellCheckingFacility.bin.exe
"C:\Users\Admin\AppData\Local\Temp\MsSpellCheckingFacility.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: RenamesItself
PID:1404

C:\Windows\SysWOW64\credssp\credssp.exe
"C:\Windows\SysWOW64\credssp\credssp.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EmotetMutantsSpam
PID:276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/276-2-0x0000000000000000-mapping.dmp

Download
memory/276-3-0x0000000000290000-0x000000000029C000-memory.dmp

Filesize
48KB

Download
memory/276-4-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1404-0-0x0000000000500000-0x000000000050C000-memory.dmp

Filesize
48KB

Download
memory/1404-1-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download