Analysis
-
max time kernel
122s -
max time network
136s -
platform
windows10_x64 -
resource
win10 -
submitted
13-07-2020 08:05
General
-
Target
MsSpellCheckingFacility.bin.exe
-
Size
104KB
-
MD5
b6830b6adf76aa6b4036f7c7456713ce
-
SHA1
3063f03906f8823068cc4a8464b28f4c96e663d4
-
SHA256
1ff36792edbc187f3c27fea4601240b03ebf68a35d99ee3b3aa98f27b4d04cf2
-
SHA512
bf43839b157e1ba8eff983ae94ac53f14f2713f8bf0a2d38641fb941f14b7d56d25dddb09e19baa09e310ed7f780c2a374599d673c0cb57ee89eddf681310bdb
Malware Config
Extracted
emotet
181.120.79.227:80
91.236.4.234:443
190.17.195.202:80
104.131.103.37:8080
190.147.137.153:443
186.3.232.68:80
190.163.1.31:8080
143.0.87.101:80
70.32.115.157:8080
177.66.190.130:80
82.196.15.205:8080
77.90.136.129:8080
175.114.178.83:443
46.28.111.142:7080
94.176.234.118:443
114.109.179.60:80
70.32.84.74:8080
172.104.169.32:8080
113.190.254.245:80
81.169.202.3:443
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious behavior: EmotetMutantsSpam 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MsSpellCheckingFacility.bin.exe"C:\Users\Admin\AppData\Local\Temp\MsSpellCheckingFacility.bin.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\crypt32\crypt32.exe"C:\Windows\SysWOW64\crypt32\crypt32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EmotetMutantsSpam
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
-
Filesize
104KB
-
Filesize
48KB
-
Filesize
104KB