Analysis

  • max time kernel
    126s
  • resource
    win10v191014
  • submitted
    14-01-2020 23:37

General

  • Target

    6f3a224371d09b7a61b73e380be5f4f4aef0420fd577b141929b9c13f1781a03

  • Sample

    200114-43bpxbxyna

  • SHA256

    6f3a224371d09b7a61b73e380be5f4f4aef0420fd577b141929b9c13f1781a03

Score
10/10

Malware Config

Extracted

Family

emotet

C2

66.7.242.50:8080

72.186.137.156:80

197.89.27.26:8080

91.250.96.22:8080

37.187.72.193:8080

104.131.44.150:8080

167.71.10.37:8080

78.24.219.147:8080

159.65.25.128:8080

95.128.43.213:8080

179.13.185.19:80

186.86.247.171:443

110.142.38.16:80

201.173.217.124:443

169.239.182.217:8080

211.63.71.72:8080

104.131.11.150:8080

190.55.181.54:443

209.146.22.34:443

64.53.242.181:8080

rsa_pubkey.plain

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Drops file in System32 directory 6 IoCs
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails

  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Suspicious behavior: EmotetMutantsSpam 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f3a224371d09b7a61b73e380be5f4f4aef0420fd577b141929b9c13f1781a03.exe
    "C:\Users\Admin\AppData\Local\Temp\6f3a224371d09b7a61b73e380be5f4f4aef0420fd577b141929b9c13f1781a03.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4952
    • C:\Users\Admin\AppData\Local\Temp\6f3a224371d09b7a61b73e380be5f4f4aef0420fd577b141929b9c13f1781a03.exe
      --92f6af0b
      2⤵
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious behavior: EmotetMutantsSpam
      • Suspicious behavior: RenamesItself
      PID:4984
  • C:\Windows\SysWOW64\malertnic.exe
    "C:\Windows\SysWOW64\malertnic.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2044
    • C:\Windows\SysWOW64\malertnic.exe
      --41be316f
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious behavior: EmotetMutantsSpam
      PID:1016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\403f0cc78adafaecdb503a6c6424923d_293fa5bd-edfb-4bba-800e-a7dce3ea3438
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-634046074-2673730973-2644684987-1000\0f5007522459c86e95ffcc62f32308f1_293fa5bd-edfb-4bba-800e-a7dce3ea3438
  • memory/1016-6-0x0000000000610000-0x0000000000627000-memory.dmp
    Filesize

    92KB

  • memory/1016-7-0x0000000000400000-0x000000000046E000-memory.dmp
    Filesize

    440KB

  • memory/2044-4-0x0000000000640000-0x0000000000657000-memory.dmp
    Filesize

    92KB

  • memory/4952-0-0x0000000002290000-0x00000000022A7000-memory.dmp
    Filesize

    92KB

  • memory/4984-2-0x00000000020A0000-0x00000000020B7000-memory.dmp
    Filesize

    92KB

  • memory/4984-3-0x0000000000400000-0x000000000046E000-memory.dmp
    Filesize

    440KB