Analysis
- max time kernel
147s - max time network
154s - platform
windows7_x64 - resource
win7v200722 - submitted
02/09/2020, 15:11
General
- Target emotet_exe_e1_40babfd984dbe7eb25016ca7432afb70f2d4671015c4d13fdf6e38771e936d05_2020-09-02__151046._exe.exe
- Size 1.1MB
- Sample200902-a328xkerbs
- SHA256 40babfd984dbe7eb25016ca7432afb70f2d4671015c4d13fdf6e38771e936d05
Malware Config
Extracted
-
emotet
-
50.121.220.50:80
-
51.75.33.122:80
-
54.37.42.48:8080
-
91.121.54.71:8080
-
45.16.226.117:443
-
68.69.155.181:80
-
213.60.96.117:80
-
77.55.211.77:8080
-
152.169.22.67:80
-
110.142.219.51:80
-
2.47.112.152:80
-
206.15.68.237:443
-
217.13.106.14:8080
-
191.99.160.58:80
-
189.131.57.131:80
-
213.197.182.158:8080
-
94.176.234.118:443
-
61.92.159.208:8080
-
190.128.173.10:80
-
219.92.8.17:8080
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 6 IoCs
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 32 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_40babfd984dbe7eb25016ca7432afb70f2d4671015c4d13fdf6e38771e936d05_2020-09-02__151046._exe.exe"C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_40babfd984dbe7eb25016ca7432afb70f2d4671015c4d13fdf6e38771e936d05_2020-09-02__151046._exe.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_40babfd984dbe7eb25016ca7432afb70f2d4671015c4d13fdf6e38771e936d05_2020-09-02__151046._exe.exe"C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_40babfd984dbe7eb25016ca7432afb70f2d4671015c4d13fdf6e38771e936d05_2020-09-02__151046._exe.exe" /scomma "C:\Users\Admin\AppData\Local\Temp\A16D.tmp"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_40babfd984dbe7eb25016ca7432afb70f2d4671015c4d13fdf6e38771e936d05_2020-09-02__151046._exe.exe"C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_40babfd984dbe7eb25016ca7432afb70f2d4671015c4d13fdf6e38771e936d05_2020-09-02__151046._exe.exe" "C:\Users\Admin\AppData\Local\Temp\88B1.tmp"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_40babfd984dbe7eb25016ca7432afb70f2d4671015c4d13fdf6e38771e936d05_2020-09-02__151046._exeseed.exe"C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_40babfd984dbe7eb25016ca7432afb70f2d4671015c4d13fdf6e38771e936d05_2020-09-02__151046._exeseed.exe" "C:\Users\Admin\AppData\Local\Temp\88B1.tmp"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_40babfd984dbe7eb25016ca7432afb70f2d4671015c4d13fdf6e38771e936d05_2020-09-02__151046._exe.exe"C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_40babfd984dbe7eb25016ca7432afb70f2d4671015c4d13fdf6e38771e936d05_2020-09-02__151046._exe.exe" /scomma "C:\Users\Admin\AppData\Local\Temp\89DA.tmp"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_40babfd984dbe7eb25016ca7432afb70f2d4671015c4d13fdf6e38771e936d05_2020-09-02__151046._exe.exe"C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_40babfd984dbe7eb25016ca7432afb70f2d4671015c4d13fdf6e38771e936d05_2020-09-02__151046._exe.exe" "C:\Users\Admin\AppData\Local\Temp\8C99.tmp"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_40babfd984dbe7eb25016ca7432afb70f2d4671015c4d13fdf6e38771e936d05_2020-09-02__151046._exepeer.exe"C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_40babfd984dbe7eb25016ca7432afb70f2d4671015c4d13fdf6e38771e936d05_2020-09-02__151046._exepeer.exe" "C:\Users\Admin\AppData\Local\Temp\8C99.tmp"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/588-18-0x0000000000400000-0x0000000000417000-memory.dmp
memory/588-16-0x0000000000400000-0x0000000000417000-memory.dmp
memory/608-12-0x0000000140000000-0x000000014001C000-memory.dmp
memory/608-9-0x0000000140000000-0x000000014001C000-memory.dmp
memory/760-2-0x0000000000400000-0x000000000041C000-memory.dmp
memory/760-4-0x0000000000400000-0x000000000041C000-memory.dmp
memory/812-13-0x0000000000400000-0x000000000045C000-memory.dmp
memory/812-15-0x0000000000400000-0x000000000045C000-memory.dmp
memory/1380-5-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1380-7-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1396-20-0x0000000140000000-0x000000014001D000-memory.dmp
memory/1396-23-0x0000000140000000-0x000000014001D000-memory.dmp
memory/1456-0-0x0000000000270000-0x000000000027C000-memory.dmp
memory/1648-1-0x000007FEF8150000-0x000007FEF83CA000-memory.dmp