Analysis
- max time kernel
143s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
20/06/2022, 02:32
General
- Target 336636f33e83a65d90de58460b62f66b168933f3685680792991fb320d04e583.exe
- Size 160KB
- Sample220620-c1ezkaebe6
- SHA256 336636f33e83a65d90de58460b62f66b168933f3685680792991fb320d04e583
Malware Config
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 34 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\336636f33e83a65d90de58460b62f66b168933f3685680792991fb320d04e583.exe"C:\Users\Admin\AppData\Local\Temp\336636f33e83a65d90de58460b62f66b168933f3685680792991fb320d04e583.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\336636f33e83a65d90de58460b62f66b168933f3685680792991fb320d04e583.exe"C:\Users\Admin\AppData\Local\Temp\336636f33e83a65d90de58460b62f66b168933f3685680792991fb320d04e583.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
-
C:\Windows\SysWOW64\defineadam.exe"C:\Windows\SysWOW64\defineadam.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\defineadam.exe"C:\Windows\SysWOW64\defineadam.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2152-162-0x0000000000290000-0x00000000002BA000-memory.dmp
memory/2152-163-0x0000000001430000-0x000000000144A000-memory.dmp
memory/2152-164-0x0000000001C90000-0x0000000001CB0000-memory.dmp
memory/2152-157-0x0000000001450000-0x000000000146A000-memory.dmp
memory/2152-153-0x0000000001450000-0x000000000146A000-memory.dmp
memory/2152-165-0x0000000001430000-0x000000000144A000-memory.dmp
memory/2316-130-0x0000000002370000-0x000000000238A000-memory.dmp
memory/2316-134-0x0000000002370000-0x000000000238A000-memory.dmp
memory/2316-142-0x0000000002350000-0x000000000236A000-memory.dmp
memory/2316-141-0x0000000000290000-0x00000000002BA000-memory.dmp
memory/2316-143-0x0000000002390000-0x00000000023B0000-memory.dmp
memory/3524-140-0x0000000002C70000-0x0000000002C8A000-memory.dmp
memory/3524-146-0x0000000002C90000-0x0000000002CB0000-memory.dmp
memory/3524-145-0x00000000012B0000-0x00000000012CA000-memory.dmp
memory/3524-144-0x0000000000290000-0x00000000002BA000-memory.dmp
memory/3524-161-0x00000000012B0000-0x00000000012CA000-memory.dmp
memory/3524-136-0x0000000002C70000-0x0000000002C8A000-memory.dmp
memory/4652-151-0x0000000000F40000-0x0000000000F5A000-memory.dmp
memory/4652-160-0x0000000001030000-0x0000000001050000-memory.dmp
memory/4652-159-0x0000000000F20000-0x0000000000F3A000-memory.dmp
memory/4652-158-0x0000000000290000-0x00000000002BA000-memory.dmp
memory/4652-147-0x0000000000F40000-0x0000000000F5A000-memory.dmp