Analysis
- max time kernel
122s - max time network
136s - platform
windows10_x64 - resource
win10 - submitted
13/07/2020, 08:05
General
- Target MsSpellCheckingFacility.bin.exe
- Size 104KB
- Sample200713-ssd5d6qpba
- SHA256 1ff36792edbc187f3c27fea4601240b03ebf68a35d99ee3b3aa98f27b4d04cf2
Score
10/10
Malware Config
Extracted
Family
-
emotet
C2
-
181.120.79.227:80
-
91.236.4.234:443
-
190.17.195.202:80
-
104.131.103.37:8080
-
190.147.137.153:443
-
186.3.232.68:80
-
190.163.1.31:8080
-
143.0.87.101:80
-
70.32.115.157:8080
-
177.66.190.130:80
-
82.196.15.205:8080
-
77.90.136.129:8080
-
175.114.178.83:443
-
46.28.111.142:7080
-
94.176.234.118:443
-
114.109.179.60:80
-
70.32.84.74:8080
-
172.104.169.32:8080
-
113.190.254.245:80
-
81.169.202.3:443
rsa_pubkey.plain
Signatures
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious behavior: EmotetMutantsSpam 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MsSpellCheckingFacility.bin.exe"C:\Users\Admin\AppData\Local\Temp\MsSpellCheckingFacility.bin.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\crypt32\crypt32.exe"C:\Windows\SysWOW64\crypt32\crypt32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EmotetMutantsSpam
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/720-0-0x0000000000A90000-0x0000000000A9C000-memory.dmp
memory/720-1-0x0000000000400000-0x000000000041A000-memory.dmp
memory/3112-3-0x00000000008C0000-0x00000000008CC000-memory.dmp
memory/3112-4-0x0000000000400000-0x000000000041A000-memory.dmp