Analysis
- max time kernel
136s - max time network
151s - platform
windows10_x64 - resource
win10 - submitted
25/10/2020, 18:31
General
- Target 99baacf81234f944749b7214a1b3196d.exe
- Size 361KB
- Sample201025-lt2xe384dx
- SHA256 a03be79683ab40fe83a0245cb4d3ef618a1c3a79a3ba3caa61e2485a2ebcc2fa
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch2
C2
-
208.180.207.205:80
-
167.114.153.111:8080
-
169.50.76.149:8080
-
87.106.136.232:8080
-
134.209.36.254:8080
-
110.145.77.103:80
-
61.19.246.238:443
-
218.147.193.146:80
-
194.4.58.192:7080
-
123.176.25.234:80
-
139.99.158.11:443
-
174.106.122.139:80
-
137.59.187.107:8080
-
37.187.72.193:8080
-
168.235.67.138:7080
-
190.108.228.27:443
-
139.59.60.244:8080
-
184.180.181.202:80
-
71.72.196.159:80
-
47.144.21.12:443
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Emotet Payload 4 IoCs
Detects Emotet payload in memory.
- Executes dropped EXE 1 IoCs
- Drops file in System32 directory 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\99baacf81234f944749b7214a1b3196d.exe"C:\Users\Admin\AppData\Local\Temp\99baacf81234f944749b7214a1b3196d.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dpapi\TpmCertResources.exe"C:\Windows\SysWOW64\dpapi\TpmCertResources.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/496-0-0x0000000002280000-0x000000000229C000-memory.dmp
memory/496-1-0x00000000022A0000-0x00000000022BB000-memory.dmp
memory/1180-4-0x0000000002150000-0x000000000216C000-memory.dmp
memory/1180-5-0x0000000002170000-0x000000000218B000-memory.dmp