Analysis

  • max time kernel
    112s
  • resource
    win7v191014
  • submitted
    14-01-2020 23:16

General

  • Target

    636a579ad0064096c649ad2bb0ad8f409d62f4348e0011600484fbf04bf6aecb

  • Sample

    200114-pz9wqeqmwn

  • SHA256

    636a579ad0064096c649ad2bb0ad8f409d62f4348e0011600484fbf04bf6aecb

Score
10/10

Malware Config

Extracted

Family

emotet

C2

76.185.136.132:80

165.255.142.118:80

186.147.245.204:80

198.58.112.7:443

143.95.101.72:8080

91.205.173.150:8080

124.150.175.133:80

51.77.113.97:8080

181.54.246.80:443

1.221.254.82:80

89.215.225.15:80

75.127.14.170:8080

160.226.171.255:443

182.187.137.199:8080

196.6.119.137:80

77.74.78.80:443

190.93.210.113:80

95.130.37.244:443

37.46.129.215:8080

114.179.127.48:80

rsa_pubkey.plain

Signatures

  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Suspicious behavior: EmotetMutantsSpam 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails

  • Drops file in System32 directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\636a579ad0064096c649ad2bb0ad8f409d62f4348e0011600484fbf04bf6aecb.exe
    "C:\Users\Admin\AppData\Local\Temp\636a579ad0064096c649ad2bb0ad8f409d62f4348e0011600484fbf04bf6aecb.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:608
    • C:\Users\Admin\AppData\Local\Temp\636a579ad0064096c649ad2bb0ad8f409d62f4348e0011600484fbf04bf6aecb.exe
      --66b8820b
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious behavior: EmotetMutantsSpam
      • Suspicious behavior: RenamesItself
      • Drops file in System32 directory
      PID:1852
  • C:\Windows\SysWOW64\acquireipmi.exe
    "C:\Windows\SysWOW64\acquireipmi.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1168
    • C:\Windows\SysWOW64\acquireipmi.exe
      --ebb390f
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious behavior: EmotetMutantsSpam
      • Suspicious behavior: EnumeratesProcesses
      • Drops file in System32 directory
      PID:1108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1774239815-1814403401-2200974991-1000\0f5007522459c86e95ffcc62f32308f1_18654976-c7db-4a1a-8859-070035d242d5
  • memory/608-0-0x00000000002E0000-0x00000000002F7000-memory.dmp
    Filesize

    92KB

  • memory/1108-5-0x00000000003D0000-0x00000000003E7000-memory.dmp
    Filesize

    92KB

  • memory/1108-6-0x0000000000400000-0x000000000046E000-memory.dmp
    Filesize

    440KB

  • memory/1168-4-0x0000000000360000-0x0000000000377000-memory.dmp
    Filesize

    92KB

  • memory/1852-2-0x0000000001C30000-0x0000000001C47000-memory.dmp
    Filesize

    92KB

  • memory/1852-3-0x0000000000400000-0x000000000046E000-memory.dmp
    Filesize

    440KB