Analysis
- max time kernel
42s - max time network
146s - platform
windows10_x64 - resource
win10 - submitted
25/10/2020, 18:46
General
- Target 99c974a9f853f1a766b3067e3f0aeb79.exe
- Size 341KB
- Sample201025-nlvl323krx
- SHA256 5377074d0f1b46ffcddef754e31369760a253a1d953d1e33ab480e3f014ea56d
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch2
C2
-
208.180.207.205:80
-
167.114.153.111:8080
-
169.50.76.149:8080
-
87.106.136.232:8080
-
134.209.36.254:8080
-
110.145.77.103:80
-
61.19.246.238:443
-
218.147.193.146:80
-
194.4.58.192:7080
-
123.176.25.234:80
-
139.99.158.11:443
-
174.106.122.139:80
-
137.59.187.107:8080
-
37.187.72.193:8080
-
168.235.67.138:7080
-
190.108.228.27:443
-
139.59.60.244:8080
-
184.180.181.202:80
-
71.72.196.159:80
-
47.144.21.12:443
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Emotet Payload 3 IoCs
Detects Emotet payload in memory.
- Executes dropped EXE 1 IoCs
- Drops file in System32 directory 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\99c974a9f853f1a766b3067e3f0aeb79.exe"C:\Users\Admin\AppData\Local\Temp\99c974a9f853f1a766b3067e3f0aeb79.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\psapi\ngccredprov.exe"C:\Windows\SysWOW64\psapi\ngccredprov.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/952-4-0x0000000000790000-0x00000000007AC000-memory.dmp
memory/3868-0-0x0000000002150000-0x000000000216C000-memory.dmp
memory/3868-1-0x0000000002170000-0x000000000218B000-memory.dmp