Analysis
- max time kernel
149s - max time network
153s - platform
windows7_x64 - resource
win7v200430 - submitted
17/07/2020, 19:55
General
- Target 3adf689fef02fdd3d0a87cb8bcfd7ed9ba8b5b6efb1ee6614a15bec6a70e8383.exe
- Size 276KB
- Sample200717-da7j24ace6
- SHA256 3adf689fef02fdd3d0a87cb8bcfd7ed9ba8b5b6efb1ee6614a15bec6a70e8383
Score
10/10
Malware Config
Extracted
Family
-
emotet
C2
-
177.144.130.105:443
-
198.27.69.201:8080
-
157.7.164.178:8081
-
78.188.170.128:80
-
203.153.216.178:7080
-
77.74.78.80:443
-
178.33.167.120:8080
-
177.0.241.28:80
-
143.95.101.72:8080
-
51.38.201.19:7080
-
181.167.35.84:80
-
41.185.29.128:8080
-
192.163.221.191:8080
-
181.164.110.7:80
-
203.153.216.182:7080
-
80.211.32.88:8080
-
113.160.180.109:80
-
185.142.236.163:443
-
192.241.220.183:8080
-
87.106.231.60:8080
rsa_pubkey.plain
Signatures
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: EmotetMutantsSpam 1 IoCs
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3adf689fef02fdd3d0a87cb8bcfd7ed9ba8b5b6efb1ee6614a15bec6a70e8383.exe"C:\Users\Admin\AppData\Local\Temp\3adf689fef02fdd3d0a87cb8bcfd7ed9ba8b5b6efb1ee6614a15bec6a70e8383.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: EmotetMutantsSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/376-0-0x00000000003B0000-0x00000000003BC000-memory.dmp
memory/376-1-0x0000000000400000-0x0000000000448000-memory.dmp