Analysis
- max time kernel
149s - max time network
154s - platform
windows10_x64 - resource
win10 - submitted
31/07/2020, 13:36
General
- Target wKXT0YVE.exe
- Size 970KB
- Sample200731-73nln7n2ys
- SHA256 66a4bcc24a129b26652b14447db81d8514448126bc64732fc142d874d5369631
Score
10/10
Malware Config
Extracted
Family
-
emotet
C2
-
73.116.193.136:80
-
185.94.252.13:443
-
149.62.173.247:8080
-
89.32.150.160:8080
-
185.94.252.12:80
-
77.90.136.129:8080
-
83.169.21.32:7080
-
104.236.161.64:8080
-
114.109.179.60:80
-
189.2.177.210:443
-
68.183.190.199:8080
-
144.139.91.187:443
-
185.94.252.27:443
-
190.181.235.46:80
-
82.196.15.205:8080
-
46.28.111.142:7080
-
181.167.96.215:80
-
202.62.39.111:80
-
219.92.13.25:80
-
191.99.160.58:80
rsa_pubkey.plain
Signatures
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Emotet Payload 2 IoCs
Detects Emotet payload in memory.
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
Processes
-
C:\Users\Admin\AppData\Local\Temp\wKXT0YVE.exe"C:\Users\Admin\AppData\Local\Temp\wKXT0YVE.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3828-0-0x0000000000550000-0x000000000055C000-memory.dmp