Analysis
-
max time kernel
47s -
max time network
55s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-11-2020 17:32
General
-
Target
f28e02bd1e9cc701437328dc7bec07b439b5b97277a7983e9ca302fbc550e48a.exe
-
Size
248KB
-
MD5
8b273f919ea075cff8c652c51a301bbb
-
SHA1
917baa65532900d1dbd0a3925a898ecf0b4cd569
-
SHA256
f28e02bd1e9cc701437328dc7bec07b439b5b97277a7983e9ca302fbc550e48a
-
SHA512
b71c4aa7259535889126742045c820f703a5a9caa49b8496620d4566da22f65706e7e617d34ac08e741d96da0f98e617daac2ca02882ab887a4f98fe432d699e
Malware Config
Extracted
emotet
Epoch2
72.27.212.209:8080
172.125.40.123:80
185.201.9.197:8080
64.207.182.168:8080
51.89.36.180:443
24.179.13.119:80
142.112.10.95:20
100.37.240.62:80
173.173.254.105:80
190.29.166.0:80
37.187.72.193:8080
194.4.58.192:7080
109.74.5.95:8080
172.86.188.251:8080
67.10.155.92:80
209.141.54.221:7080
202.134.4.211:8080
172.91.208.86:80
220.245.198.194:80
120.150.218.241:443
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet Payload 4 IoCs
Detects Emotet payload in memory.
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f28e02bd1e9cc701437328dc7bec07b439b5b97277a7983e9ca302fbc550e48a.exe"C:\Users\Admin\AppData\Local\Temp\f28e02bd1e9cc701437328dc7bec07b439b5b97277a7983e9ca302fbc550e48a.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\appmgr\mfh263enc.exe"C:\Windows\SysWOW64\appmgr\mfh263enc.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\appmgr\mfh263enc.exeMD5
8b273f919ea075cff8c652c51a301bbb
SHA1917baa65532900d1dbd0a3925a898ecf0b4cd569
SHA256f28e02bd1e9cc701437328dc7bec07b439b5b97277a7983e9ca302fbc550e48a
SHA512b71c4aa7259535889126742045c820f703a5a9caa49b8496620d4566da22f65706e7e617d34ac08e741d96da0f98e617daac2ca02882ab887a4f98fe432d699e
-
memory/576-0-0x0000000000450000-0x0000000000462000-memory.dmpFilesize
72KB
-
memory/576-1-0x0000000000470000-0x0000000000480000-memory.dmpFilesize
64KB
-
memory/3692-2-0x0000000000000000-mapping.dmp
-
memory/3692-4-0x0000000000490000-0x00000000004A2000-memory.dmpFilesize
72KB
-
memory/3692-5-0x00000000005D0000-0x00000000005E0000-memory.dmpFilesize
64KB