Analysis

  • max time kernel
    113s
  • resource
    win7v191014
  • submitted
    14-01-2020 23:30

General

  • Target

    c80d1d5a7d7d1d4441b4356e161f478e16a7609614a8a65afccd9829ec26ac61

  • Sample

    200114-my3pp9lrz6

  • SHA256

    c80d1d5a7d7d1d4441b4356e161f478e16a7609614a8a65afccd9829ec26ac61

Score
10/10

Malware Config

Extracted

Family

emotet

C2

70.184.69.146:80

186.177.165.196:443

139.47.135.215:80

192.241.143.52:8080

159.65.241.220:8080

45.79.95.107:443

69.163.33.84:8080

177.34.142.163:80

200.123.183.137:443

2.47.112.72:80

190.17.44.48:80

187.54.225.76:80

190.219.149.236:80

190.100.153.162:443

58.171.38.26:80

91.205.215.57:7080

152.231.89.226:80

94.176.234.118:443

201.213.100.141:8080

203.25.159.3:8080

rsa_pubkey.plain

Signatures

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Suspicious behavior: EmotetMutantsSpam 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c80d1d5a7d7d1d4441b4356e161f478e16a7609614a8a65afccd9829ec26ac61.exe
    "C:\Users\Admin\AppData\Local\Temp\c80d1d5a7d7d1d4441b4356e161f478e16a7609614a8a65afccd9829ec26ac61.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1120
    • C:\Users\Admin\AppData\Local\Temp\c80d1d5a7d7d1d4441b4356e161f478e16a7609614a8a65afccd9829ec26ac61.exe
      --cb238e53
      2⤵
      • Suspicious behavior: RenamesItself
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious behavior: EmotetMutantsSpam
      PID:1640
  • C:\Windows\SysWOW64\pdftrns.exe
    "C:\Windows\SysWOW64\pdftrns.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1864
    • C:\Windows\SysWOW64\pdftrns.exe
      --ae2182ab
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious behavior: EmotetMutantsSpam
      PID:1964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1774239815-1814403401-2200974991-1000\0f5007522459c86e95ffcc62f32308f1_18654976-c7db-4a1a-8859-070035d242d5
  • memory/1120-0-0x0000000000300000-0x0000000000317000-memory.dmp
    Filesize

    92KB

  • memory/1640-2-0x0000000000310000-0x0000000000327000-memory.dmp
    Filesize

    92KB

  • memory/1640-3-0x0000000000400000-0x000000000046E000-memory.dmp
    Filesize

    440KB

  • memory/1864-4-0x00000000004F0000-0x0000000000507000-memory.dmp
    Filesize

    92KB

  • memory/1964-5-0x0000000000950000-0x0000000000967000-memory.dmp
    Filesize

    92KB

  • memory/1964-6-0x0000000000400000-0x000000000046E000-memory.dmp
    Filesize

    440KB