Analysis
- max time kernel
148s - max time network
150s - platform
windows10_x64 - resource
win10 - submitted
25/10/2020, 18:23
General
- Target 70847c1661570e9dbeb4d69ee3112db6.exe
- Size 373KB
- Sample201025-dkjs94q4es
- SHA256 596d2fd92db8724106a0c016ba425f1ee274e97895244507556b21ca2ad02a30
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch2
C2
-
208.180.207.205:80
-
167.114.153.111:8080
-
169.50.76.149:8080
-
87.106.136.232:8080
-
134.209.36.254:8080
-
110.145.77.103:80
-
61.19.246.238:443
-
218.147.193.146:80
-
194.4.58.192:7080
-
123.176.25.234:80
-
139.99.158.11:443
-
174.106.122.139:80
-
137.59.187.107:8080
-
37.187.72.193:8080
-
168.235.67.138:7080
-
190.108.228.27:443
-
139.59.60.244:8080
-
184.180.181.202:80
-
71.72.196.159:80
-
47.144.21.12:443
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Emotet Payload 4 IoCs
Detects Emotet payload in memory.
- Executes dropped EXE 1 IoCs
- Drops file in System32 directory 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\70847c1661570e9dbeb4d69ee3112db6.exe"C:\Users\Admin\AppData\Local\Temp\70847c1661570e9dbeb4d69ee3112db6.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DxpTaskSync\KBDMONST.exe"C:\Windows\SysWOW64\DxpTaskSync\KBDMONST.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1584-4-0x0000000000540000-0x000000000055C000-memory.dmp
memory/1584-5-0x0000000002050000-0x000000000206B000-memory.dmp
memory/3888-0-0x00000000020B0000-0x00000000020CC000-memory.dmp
memory/3888-1-0x0000000002160000-0x000000000217B000-memory.dmp