Analysis
- max time kernel
138s - max time network
139s - platform
windows7_x64 - resource
win7v20201028 - submitted
06/11/2020, 00:49
General
- Target ff3eb1017295f86b2e784c51ff91c0cfcfba7001364fd78dc3defa16db045b71.exe
- Size 572KB
- Sample201106-aestphdvds
- SHA256 ff3eb1017295f86b2e784c51ff91c0cfcfba7001364fd78dc3defa16db045b71
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch1
C2
-
78.206.229.130:80
-
70.39.251.94:8080
-
87.230.25.43:8080
-
94.23.62.116:8080
-
137.74.106.111:7080
-
76.121.199.225:80
-
177.73.0.98:443
-
152.169.22.67:80
-
174.118.202.24:443
-
168.197.45.36:80
-
181.123.6.86:80
-
12.162.84.2:8080
-
191.182.6.118:80
-
177.23.7.151:80
-
2.84.12.98:80
-
213.197.182.158:8080
-
170.81.48.2:80
-
79.118.74.90:80
-
109.101.137.162:8080
-
111.67.12.221:8080
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Emotet Payload 1 IoCs
Detects Emotet payload in memory.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff3eb1017295f86b2e784c51ff91c0cfcfba7001364fd78dc3defa16db045b71.exe"C:\Users\Admin\AppData\Local\Temp\ff3eb1017295f86b2e784c51ff91c0cfcfba7001364fd78dc3defa16db045b71.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/324-4-0x000007FEF69C0000-0x000007FEF6C3A000-memory.dmp
memory/1704-3-0x00000000006B0000-0x00000000006C0000-memory.dmp