Analysis

  • max time kernel
    146s
  • max time network
    155s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    09-09-2021 07:49

General

  • Target

    2cb7516c937ad8b9467ca417530651e34340d231c3696149c7d7b22e24ffaf9b.exe

  • Size

    356KB

  • MD5

    3639d17c4944743ac5c70c4e1bd30178

  • SHA1

    0047a882cf542b94754496c8cb985ab64561f72c

  • SHA256

    2cb7516c937ad8b9467ca417530651e34340d231c3696149c7d7b22e24ffaf9b

  • SHA512

    efbc3c75d893baa3e5fc5329ef7bc3163e686850f9196e2ba758b486b18743fd2487476976d6c55b826da2ab1a017ae854af0c53d4b95865a5221a387ba9ad11

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

102.182.145.130:80

173.173.254.105:80

64.207.182.168:8080

51.89.199.141:8080

167.114.153.111:8080

173.63.222.65:80

218.147.193.146:80

59.125.219.109:443

172.104.97.173:8080

190.162.215.233:80

68.115.186.26:80

78.188.106.53:443

190.240.194.77:443

24.133.106.23:80

80.227.52.78:80

79.137.83.50:443

120.150.218.241:443

62.171.142.179:8080

194.4.58.192:7080

62.30.7.67:443

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet Payload 3 IoCs

    Detects Emotet payload in memory.

  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2cb7516c937ad8b9467ca417530651e34340d231c3696149c7d7b22e24ffaf9b.exe
    "C:\Users\Admin\AppData\Local\Temp\2cb7516c937ad8b9467ca417530651e34340d231c3696149c7d7b22e24ffaf9b.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1400
  • \??\c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NgcSvc
    1⤵
      PID:792
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
      1⤵
        PID:3016
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s NgcCtnrSvc
        1⤵
        • Modifies data under HKEY_USERS
        PID:1116

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1400-114-0x0000000002A10000-0x0000000002A44000-memory.dmp
        Filesize

        208KB

      • memory/1400-117-0x0000000002EC0000-0x0000000002EF3000-memory.dmp
        Filesize

        204KB

      • memory/1400-119-0x0000000002ED0000-0x0000000002EF3000-memory.dmp
        Filesize

        140KB

      • memory/1400-120-0x00000000029D0000-0x0000000002A01000-memory.dmp
        Filesize

        196KB