Analysis
- max time kernel
137s - max time network
149s - platform
windows7_x64 - resource
win7 - submitted
25/10/2020, 17:24
General
- Target d49ee02f94979032b7a5e08725f60bd3.exe
- Size 332KB
- Sample201025-4dexhm96da
- SHA256 018559ab9cf2f0408b72b37f39cfc58cc75a110b25299dcb1f38dc4eb87d1453
Malware Config
Extracted
-
emotet
-
Epoch1
-
202.22.141.45:80
-
37.187.161.206:8080
-
202.29.239.162:443
-
80.87.201.221:7080
-
82.76.111.249:443
-
216.47.196.104:80
-
192.241.143.52:8080
-
192.81.38.31:80
-
87.106.253.248:8080
-
64.201.88.132:80
-
192.241.146.84:8080
-
12.162.84.2:8080
-
1.226.84.243:8080
-
177.129.17.170:443
-
202.134.4.210:7080
-
70.169.17.134:80
-
152.169.22.67:80
-
5.196.35.138:7080
-
138.97.60.141:7080
-
203.205.28.68:80
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Emotet Payload 2 IoCs
Detects Emotet payload in memory.
- Executes dropped EXE 1 IoCs
- Drops file in System32 directory 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d49ee02f94979032b7a5e08725f60bd3.exe"C:\Users\Admin\AppData\Local\Temp\d49ee02f94979032b7a5e08725f60bd3.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DisplaySwitch\wlanapi.exe"C:\Windows\SysWOW64\DisplaySwitch\wlanapi.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1472-3-0x0000000000310000-0x0000000000320000-memory.dmp
memory/1472-7-0x0000000002690000-0x0000000002694000-memory.dmp
memory/1472-5-0x0000000000460000-0x0000000000464000-memory.dmp
memory/1648-11-0x0000000000280000-0x0000000000290000-memory.dmp
memory/1776-12-0x000007FEF6BE0000-0x000007FEF6E5A000-memory.dmp